CVE-2026-101046
Received Received - Intake

SQL Injection in Fleet Activity Endpoints

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-101046
EUVD
EUVD-2026-87977

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fleetdm fleet to 4.89.0 (exc)
fleet fleet 4.89.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-101046 is an SQL injection vulnerability in Fleet software versions before 4.89.0. It affects the activity list endpoints where user-supplied sort parameters are directly interpolated into SQL ORDER BY clauses without validation. This allows authenticated users with read access to Activity to order results by arbitrary columns on the activity_past table, enabling read-only access to additional data not normally returned in responses.

Detection Guidance

To detect this vulnerability, check Fleet server versions prior to 4.89.0. Inspect logs for suspicious activity in endpoints GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities. Look for ORDER BY clauses with arbitrary column names in SQL queries.

Impact Analysis

The impact is limited to read-only access to non-sensitive columns on the activity_past table. An attacker could infer values through sort order but cannot write data, escalate privileges, or access sensitive information like node_key or host-join columns. The attack requires low privileges and has minimal confidentiality impact.

Compliance Impact

The vulnerability poses minimal compliance risk as it only allows read-only access to non-sensitive data and does not involve unauthorized data exposure or modification. No evidence suggests it directly violates GDPR or HIPAA, but organizations should still apply the patch to maintain security best practices.

Mitigation Strategies

Upgrade Fleet to version 4.89.0 or later immediately. Ensure no unauthorized access to Activity endpoints exists. Review and restrict user permissions to read-only access for Activity data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101046. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart