EUVD-2026-87977
GHSA-qhx2-24jf-9jj9
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated Activity-read user (PR:L) over network (AV:N); AC:H because impact is only a blind sort oracle over bounded columns; read-only so C:L, I:N, A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.
AnalysisAI
SQL injection in FleetDM Fleet before 4.89.0 allows an authenticated user holding read access to Activity to influence the ORDER BY clause on the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities), because the deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key without an allowlist. The impact is read-only and tightly bounded: it acts as a blind sort-order oracle that can only infer values from columns on the activity_past table (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Fleet account holding read access to Activity (PR:L) and reachability of the activity list endpoints (GET /api/v1/fleet/activities or GET /api/v1/fleet/hosts/{id}/activities) on Fleet versions before 4.89.0 where the deprecated appendListOptionsWithCursorToSQL helper interpolates the sort/order key without an allowlist. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuinely low-priority issue despite the SQLi classification. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Fleet 4.89.0 or later (fleet-v4.89.0), which is the vendor-released fix: it removes the deprecated appendListOptionsWithCursorToSQL helper and passes the caller-supplied sort column through SanitizeColumn on both activity endpoints. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Unauthenticated attackers can bypass authentication in Fleet (versions before 4.87.0) by using non-secret device identif
OS command injection in Fleet's generator for Fleet-maintained macOS app install and uninstall scripts allows crafted Ho
Privilege escalation in SUSE Rancher Fleet (0.14.x before 0.14.11, 0.15.x before 0.15.7, and 0.16.x before 0.16.2) lets
SQL injection in Fleet device management software before version 4.80.1 allows authenticated users to manipulate the ord
Fleet device management software versions prior to 4.78.3 suffer from broken access control that permits any authenticat
fleetdm/fleet is an open source device management, built on osquery. Rated high severity (CVSS 8.1), this vulnerability
Fleet before 2.1.2 allows exposure of SMTP credentials. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Cross-tenant authorization bypass in SUSE Rancher Fleet allows a party who can perform agent-initiated cluster registrat
Unauthenticated download of in-house iOS application packages and manifests is possible against enterprise-tier Fleet de
Denial-of-service vulnerability in Fleet device management software prior to version 4.81.0 allows authenticated hosts t
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today