Executive brief
Fleet is a popular open-source device management platform used to monitor and manage computers and mobile devices across organizations. An authenticated user with read-only access to activity logs could manipulate how those logs are sorted by injecting arbitrary SQL column names, potentially exposing non-public database columns. While this does not allow data modification or privilege escalation, it could lead to information disclosure about internal database structure or activity details not normally visible in query results.
Technical details
Fleet's activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities) used a deprecated cursor-pagination helper that interpolated the caller-supplied ORDER BY column directly into SQL without an allowlist. This is a form of second-order SQL injection where column names are not validated. An authenticated user with Activity read permission could supply arbitrary sort columns to access or infer the presence of columns not returned in the normal API response (e.g., the 'details' field in /api/v1/fleet/activities). The vulnerability was strictly limited to columns in the activity_past table, and the original report's more severe node_key extraction path was already remediated in a separate fix. The fix removes the vulnerable helper and passes all user-supplied sort columns through a SanitizeColumn function that strips all characters except alphanumeric, hyphen, dot, and backticks, making SQL injection via column names infeasible.
Affected products
- Fleet Fleet < 4.89.0
Timeline
- 2026-08-20: disclosed: Public disclosure via GitHub Advisory Database
- 2026-08-20: patched: Fixed in Fleet v4.89.0