{"id":"EUVD-2026-87977","enisaUuid":"de59c116-a499-35aa-85a1-c4d9d4569d66","description":"Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.","datePublished":"Sep 27, 2026, 5:02:35 PM","dateUpdated":"Sep 28, 2026, 1:16:02 PM","baseScore":2.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-rxhg-vcww-2mpw\nhttps://www.vulncheck.com/advisories/fleet-before-4.89.0-sql-injection-via-order-by-activity-endpoints\n","aliases":"CVE-2026-101046\nGHSA-qhx2-24jf-9jj9\n","assigner":"VulnCheck","epss":0.17,"enisaIdProduct":[{"id":"d547188e-fa1e-3341-99bc-952b0ffec8fc","product":{"name":"Fleet","vendor":{"name":"fleetdm"}},"product_version":"0 \u003c4.89.0"}],"enisaIdVendor":[{"id":"dc93e197-4c68-3c9f-a776-487559e67e70","vendor":{"name":"fleetdm"}}],"enisaIdVulnerability":[{"id":"6f806a4d-e5d6-3df3-a041-fbde0eedd2b9","vulnerability":{"id":"GHSA-qhx2-24jf-9jj9","description":"Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.","datePublished":"Sep 27, 2026, 6:30:23 PM","dateUpdated":"Sep 27, 2026, 6:30:23 PM","baseScore":0.0,"references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-rxhg-vcww-2mpw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101046\nhttps://www.vulncheck.com/advisories/fleet-before-4.89.0-sql-injection-via-order-by-activity-endpoints\n","enisa_id":"EUVD-2026-87977\n","aliases":"GHSA-qhx2-24jf-9jj9\nCVE-2026-101046\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c5d7848f-6bc4-3aea-bc0a-bae48f7ba8f2","vulnerability":{"id":"CVE-2026-101046","description":"Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.","datePublished":"Sep 27, 2026, 5:02:35 PM","dateUpdated":"Sep 28, 2026, 1:16:02 PM","status":"PUBLISHED","baseScore":2.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-rxhg-vcww-2mpw\nhttps://www.vulncheck.com/advisories/fleet-before-4.89.0-sql-injection-via-order-by-activity-endpoints\n","enisa_id":"EUVD-2026-87977\n","assigner":"VulnCheck","epss":0.17,"dataProcessed":"Oct 29, 2026, 7:14:36 AM","vulnerabilityProduct":[{"id":"9d8a5f3b-1e32-349f-aeeb-69ae033077d9","product":{"name":"Fleet","vendor":{"name":"fleetdm"}},"product_version":"0 \u003c4.89.0"}],"vulnerabilityVendor":[{"id":"7c0dbe34-4a23-3686-b3c4-49ae78429c5f","vendor":{"name":"fleetdm"}}]}}],"enisaIdAdvisory":[]}