Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 20 August 2026.

Which products and versions are affected?

github.com/fleetdm/fleet/v4 (Go) < 4.89.0.

Is there a fix for This vulnerability?

A patch was published on 2026-08-20: Fixed in Fleet v4.89.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run github.com/fleetdm/fleet/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Fleet ORDER BY column injection in activity endpoints

Q: Is there a fix for This vulnerability?

A patch was published on 2026-08-20: Fixed in Fleet v4.89.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run github.com/fleetdm/fleet/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · CVSS 3.1 · Published 2026-08-20

Fleet is a popular open-source device management platform used to monitor and manage computers and mobile devices across organizations. An authenticated user with read-only access to activity logs could manipulate how those logs are sorted by injecting arbitrary SQL column names, potentially exposing non-public database columns. While this does not allow data modification or privilege escalation, it could lead to information disclosure about internal database structure or activity details not normally visible in query results.

Technologies: github.com/fleetdm/fleet/v4 (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 20 August 2026.
Which products and versions are affected?: github.com/fleetdm/fleet/v4 (Go) < 4.89.0.
Is there a fix for This vulnerability?: A patch was published on 2026-08-20: Fixed in Fleet v4.89.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run github.com/fleetdm/fleet/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Fleet's activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities) used a deprecated cursor-pagination helper that interpolated the caller-supplied ORDER BY column directly into SQL without an allowlist. This is a form of second-order SQL injection where column names are not validated. An authenticated user with Activity read permission could supply arbitrary sort columns to access or infer the presence of columns not returned in the normal API response (e.g., the 'details' field in /api/v1/fleet/activities). The vulnerability was strictly limited to columns in the activity_past table, and the original report's more severe node_key extraction path was already remediated in a separate fix. The fix removes the vulnerable helper and passes all user-supplied sort columns through a SanitizeColumn function that strips all characters except alphanumeric, hyphen, dot, and backticks, making SQL injection via column names infeasible.

Affected products

Fleet Fleet < 4.89.0

Timeline

2026-08-20: disclosed: Public disclosure via GitHub Advisory Database
2026-08-20: patched: Fixed in Fleet v4.89.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.