CVE-2026-101046

Katalog CVE

CVSS 4.3 · Medium EPSS 0,17%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada fleetdm fleet. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.

Rincian

Terbit di NVD

27 September 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/fleetdm/fleet/security/advisories/GHSA-rxhg-vcww-2mpw advisory vendor · mitigasi
• https://www.vulncheck.com/advisories/fleet-before-4.89.0-sql-injection-via-order-by-activity-endpoints advisory pihak ketiga