CVE-2026-101046: Fleet SQL Injection Vulnerability

CVE-2026-101046 Overview

CVE-2026-101046 is a SQL injection vulnerability [CWE-89] in Fleet device management platform versions prior to 4.89.0. The flaw resides in the activity list endpoints GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities. The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort and order key directly into the ORDER BY clause without an allowlist. An authenticated user with read access to Activity could order results by arbitrary columns on the activity_past table. The impact is read-only and inference-based, bounded to columns not otherwise exposed in these responses.

Critical Impact
Authenticated attackers can infer values of non-returned columns (such as details) on the activity_past table through sort-order-based data exfiltration.

Affected Products

Fleet (fleetdm/fleet) versions prior to 4.89.0
Fleet activity list API endpoint GET /api/v1/fleet/activities
Fleet host activity endpoint GET /api/v1/fleet/hosts/{id}/activities

Discovery Timeline

2026-09-27 - CVE-2026-101046 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101046

Vulnerability Analysis

The vulnerability stems from unsafe string interpolation of user-supplied input into a SQL ORDER BY clause. Fleet exposed activity listings through two REST endpoints that accepted sort and order parameters from query strings. The backend passed these values into the deprecated helper appendListOptionsWithCursorToSQL, which concatenated them into the generated SQL without validating that the column name belonged to an allowlist of safe fields.

Because ORDER BY cannot be parameterized through prepared statements, column names must be validated against a known-good list. The deprecated helper skipped this check, enabling an authenticated caller to sort results by any column present on the activity_past table, including columns the API never returned.

The impact is read-only. The vulnerability does not permit writes, privilege escalation, or access to node_key or host-join columns through these endpoints. However, an attacker can perform blind inference by observing changes in result ordering to deduce values of hidden columns such as details.

Root Cause

The root cause is missing input validation on the sort column parameter inside appendListOptionsWithCursorToSQL. The helper trusted caller-supplied strings and placed them into the ORDER BY clause verbatim. Fleet's safer alternative, SanitizeColumn, enforces an allowlist and was not applied on this code path. The fix in 4.89.0 removes the deprecated helper and routes the sort column through SanitizeColumn.

Attack Vector

Exploitation requires authenticated access to Fleet with read permission on Activity. An attacker crafts HTTP requests to the vulnerable endpoints and manipulates the order_key parameter to reference arbitrary columns on activity_past. By repeatedly ordering by a target column and observing the resulting sequence of returned rows, the attacker can infer the ordering, and therefore the values, of columns such as details that are not included in the JSON response.

// Example exploitation code (sanitized)
See the GitHub Security Advisory and VulnCheck advisory below for
technical details on the vulnerable ORDER BY construction. No
verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-101046

Indicators of Compromise

Repeated requests to GET /api/v1/fleet/activities or GET /api/v1/fleet/hosts/{id}/activities with varying or unusual order_key values from the same authenticated session.
order_key parameter values that do not correspond to fields returned in normal API responses (for example, details).
High-volume paginated reads of activity endpoints by a single user account over short time windows, consistent with blind inference enumeration.

Detection Strategies

Instrument the Fleet application or reverse proxy to log full query strings for the two affected endpoints and alert on non-standard order_key values.
Baseline normal API usage per Fleet user and flag deviations in request volume to activity endpoints.
Review database query logs for ORDER BY clauses on activity_past that reference columns not used by the application UI.

Monitoring Recommendations

Enable audit logging on the Fleet server and forward logs to a centralized SIEM for correlation with user activity.
Monitor authentication events for Fleet accounts with Activity read access and investigate sudden spikes in API usage.
Track Fleet server version across your fleet-management infrastructure to confirm all instances are at 4.89.0 or later.

How to Mitigate CVE-2026-101046

Immediate Actions Required

Upgrade Fleet to version 4.89.0 or later, which removes the deprecated appendListOptionsWithCursorToSQL helper and validates sort columns through SanitizeColumn.
Audit Fleet user accounts and revoke Activity read access from any account that does not require it.
Review historical access logs for the two affected endpoints to identify any suspicious order_key usage prior to patching.

Patch Information

The vulnerability is fixed in Fleet 4.89.0. The patch removes the deprecated cursor-pagination helper and passes the sort column through SanitizeColumn, which enforces an allowlist of permitted column names. See the GitHub Security Advisory and the VulnCheck SQL Injection Advisory for additional technical details.

Workarounds

Restrict network access to the Fleet API to trusted administrative networks until the upgrade is applied.
Temporarily remove Activity read permissions from non-administrative Fleet roles to reduce the pool of users who can reach the vulnerable endpoints.
Deploy a web application firewall rule that rejects requests to the two affected endpoints when order_key does not match a known-safe allowlist of column names.

bash

# Configuration example
# Upgrade Fleet to the fixed release (container deployment example)
docker pull fleetdm/fleet:v4.89.0
docker stop fleet && docker rm fleet
docker run -d --name fleet \
  -p 8080:8080 \
  --env-file /etc/fleet/fleet.env \
  fleetdm/fleet:v4.89.0

# Verify version after restart
curl -s https://fleet.example.com/api/v1/fleet/version