Fleet
CVE-2026-26186
HIGH
GHSA-49xw-vfc4-7p43
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Fleet application
-
DeliveryCraft malicious SQL in order_key parameter
-
ExploitInject SQL via unsafe goqu.I()
-
ExecutionExecute blind SQL injection
-
ImpactExtract sensitive data or modify database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user account required with access to Fleet endpoints accepting order_key query parameter; vulnerable versions prior to 4.80.1; Fleet application with MySQL backend; unsafe goqu.I() identifier quoting in ORDER BY clause construction. |
| Impact | CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication. |
| Exploit ScenarioDerived | An attacker (requires authentication) could exploit this flaw, degraded performance or denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SQL injection in Fleet device management software before version 4.80.1 allows authenticated users to manipulate the order_key parameter and inject arbitrary SQL commands through improper identifier handling in ORDER BY clauses. An attacker with valid credentials can exploit this vulnerability to perform blind SQL injection attacks, potentially extracting sensitive database information or causing denial of service through resource exhaustion. No patch is currently available for this high-severity vulnerability affecting MySQL implementations.
Earlier versions of this analysis (1)
Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the order_key query parameter. [CVSS 8.8 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-89 (SQL Injection). Affects Fleet. Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the order_key query parameter. Due to unsafe use of goqu.I() when constructing the ORDER BY clause, specially crafted input could escape identifier quoting and be interpreted as executable SQL. An authenticated attacker with access to the affected endpoint could inject SQL expressions into the underlying MySQL query.
Know when Fleet gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the order_key query parameter. Due to unsafe use of goqu.I() when constructing the ORDER BY clause, specially crafted input could escape identifier quoting and be interpreted as executable SQL. An authenticated attacker with access to the affected endpoint could inject SQL expressions into the underlying MySQL query. Although the injection occurs in an ORDER BY context, it is sufficient to enable blind SQL injection techniques that can disclose database information through conditional expressions that affect result ordering. Crafted expressions may also cause excessive computation or query failures, potentially leading to degraded performance or denial of service. No direct evidence of reliable data modification or stacked query execution was demonstrated. Version 4.80.1 fixes the issue. If an immediate upgrade is not possible, users should restrict access to the affected endpoint to trusted roles only and ensure that any user-supplied sort or column parameters are strictly allow-listed at the application or proxy layer.
Executive ViewAI
Fleet device management software contains a SQL injection vulnerability affecting all versions prior to 4.80.1 that allows authenticated users to execute arbitrary database queries. Organizations running vulnerable versions face potential data breach, unauthorized access to managed devices, and compromise of the entire device management infrastructure.
Restrict network access to Fleet administration interfaces via firewall rules and VPN-only access; implement database query logging and alerting for suspicious SQL patterns; deploy Web Application Firewall (WAF) rules to sanitize or block order_key parameters containing SQL keywords; restrict database user permissions to read-only where possible; disable or restrict use of the affected query parameter until patch availability; conduct increased monitoring of device management audit trails for unauthorized access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Unauthenticated attackers can bypass authentication in Fleet (versions before 4.87.0) by using non-secret device identif
OS command injection in Fleet's generator for Fleet-maintained macOS app install and uninstall scripts allows crafted Ho
Privilege escalation in SUSE Rancher Fleet (0.14.x before 0.14.11, 0.15.x before 0.15.7, and 0.16.x before 0.16.2) lets
Fleet device management software versions prior to 4.78.3 suffer from broken access control that permits any authenticat
fleetdm/fleet is an open source device management, built on osquery. Rated high severity (CVSS 8.1), this vulnerability
Fleet before 2.1.2 allows exposure of SMTP credentials. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Cross-tenant authorization bypass in SUSE Rancher Fleet allows a party who can perform agent-initiated cluster registrat
Unauthenticated download of in-house iOS application packages and manifests is possible against enterprise-tier Fleet de
Denial-of-service vulnerability in Fleet device management software prior to version 4.81.0 allows authenticated hosts t
Fleet device management software versions prior to 4.81.1 allow malicious enrolled Windows devices to access Mobile Devi
Exploit-DB