CVE-2026-101046

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.89.0

Description An SQL injection exists in the activity list endpoints 'GET /api/v1/fleet/activities' and 'GET /api/v1/fleet/hosts/{id}/activities'. The issue stems from the deprecated cursor-pagination helper appendListOptionsWithCursorToSQL, which interpolates caller-supplied sort/order keys into the SQL ORDER BY clause without using an allowlist. This allows an authenticated user with read access to Activity to order results by arbitrary columns. The impact is read-only and limited to columns on the activity past table that are not typically returned in responses, such as details, enabling their values to be inferred via the sort order. This does not allow write access, privilege escalation, or access to node key or other host-join columns.

Recommendations Update to version 4.89.0.