DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-RXHG-VCWW-2MPW: GHSA-RXHG-VCWW-2MPW: SQL Injection via ORDER BY Column Injection in Fleet Activity List Endpoints

#security #cve #cybersecurity #ghsa

GHSA-RXHG-VCWW-2MPW: SQL Injection via ORDER BY Column Injection in Fleet Activity List Endpoints

Vulnerability ID: GHSA-RXHG-VCWW-2MPW
CVSS Score: 8.1
Published: 2026-08-20

A SQL injection vulnerability exists in the activity list endpoints of Fleet Device Management. Authenticated users can manipulate the order_key parameter to sort database queries by arbitrary columns, including columns not projected in the SELECT query. This flaw allows attackers to establish an inference oracle to extract sensitive information from the database.

TL;DR

An authenticated SQL injection vulnerability in Fleet allows attackers to use the ORDER BY clause on activity endpoints as an inference oracle, enabling character-by-character database exfiltration.

Technical Details

  • CWE ID: CWE-89
  • Attack Vector: Network (Authenticated)
  • Vulnerability Type: SQL Injection / Information Disclosure
  • CVSS v3.1 Score: 8.1
  • Exploit Status: None / Theoretical
  • KEV Status: Not Listed
  • Affected Component: Activity List Endpoints

Affected Systems

  • Fleet Device Management Platform
  • Fleet: < 4.89.1 (Fixed in: 4.89.1)

Code Analysis

Commit: 8b9e6fb

Enforce ORDER BY allowlist on activity list endpoints (#49624)

Mitigation Strategies

  • Upgrade Fleet server to version 4.89.1, 4.90.0, or subsequent releases.
  • Deploy WAF rules to validate and restrict the character set of the order_key query parameter on activity feeds.
  • Implement audit logging on MySQL and Fleet API requests to monitor for anomalous sorting strings.

Remediation Steps:

  1. Identify all deployed instances of the Fleet server.
  2. Pull the updated Docker image or binary for version 4.90.0 or 4.89.1.
  3. Apply the updated container/binary to the production environment.
  4. Run automated validation tests to confirm that sending arbitrary order_key values yields a 422 Unprocessable Entity status code.

References

Read the full report for GHSA-RXHG-VCWW-2MPW on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)