Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-101046 · Microsoft / collected KEV context

EUVD-2026-87977

GHSA-qhx2-24jf-9jj9

GHSA-rxhg-vcww-2mpw

GO-2026-6269

cve-program · CVE-2026-101046

• https://github.com/fleetdm/fleet/security/advisories/GHSA-rxhg-vcww-2mpw
• https://www.vulncheck.com/advisories/fleet-before-4.89.0-sql-injection-via-order-by-activity-endpoints

euvd · EUVD-2026-87977

• https://github.com/fleetdm/fleet/security/advisories/GHSA-rxhg-vcww-2mpw
• https://www.vulncheck.com/advisories/fleet-before-4.89.0-sql-injection-via-order-by-activity-endpoints

nvd · CVE-2026-101046

• https://github.com/fleetdm/fleet/security/advisories/GHSA-rxhg-vcww-2mpw
• https://www.vulncheck.com/advisories/fleet-before-4.89.0-sql-injection-via-order-by-activity-endpoints

osv · GHSA-rxhg-vcww-2mpw

• https://github.com/fleetdm/fleet/security/advisories/GHSA-rxhg-vcww-2mpw
• https://github.com/fleetdm/fleet
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.89.0

osv · GO-2026-6269

• https://github.com/fleetdm/fleet/security/advisories/GHSA-rxhg-vcww-2mpw
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.89.0

No related operational record is retained in the current change model.