CVE-2026-101046 fleetdm CVE debrief

Who should care

Defenders responsible for Fleet deployments should assess exposure and apply the patch to prevent potential exploitation. They should also verify Fleet version, review official advisories, and monitor for potential exploitation attempts. Security teams and vulnerability management teams should prioritize verifying exposure and applying the patch.

Why it matters

CVE-2026-101046 is a read-only SQL injection vulnerability in Fleet before 4.89.0 that allows authenticated users to infer sensitive data. Defenders should verify exposure, apply the patch, and monitor for potential exploitation attempts.

• Read-only inference of sensitive data in activity_past table columns
• Potential data exposure through inference of non-returned column values
• Verification of Fleet version and patch application priority

Technical summary

The SQL injection vulnerability in Fleet before 4.89.0 is due to the deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolating the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist. This allows an authenticated user with read access to Activity to order results by arbitrary columns, potentially inferring values in the activity_past table. The impact is read-only and bounded to specific columns, allowing inference of values not otherwise returned in responses. Fixed in 4.89.0.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for read-only inference of sensitive data.

Recommended defensive actions

• Verify Fleet version and exposure to the vulnerability
• Apply patch to upgrade to Fleet 4.89.0 or later
• Monitor activity list endpoints for potential exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and source references provide details on the SQL injection vulnerability in Fleet before 4.89.0. The NVD entry is currently Received. Defenders should verify exposure, review official advisories, and monitor for potential exploitation attempts. Evidence is limited, and further verification is required to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.