CVE-2026-26186

Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the `order_key` query parameter. Due to unsafe use of `goqu.I()` when constructing the `ORDER BY` clause, specially crafted input could escape identifier quoting and be interpreted as executable SQL. An authenticated attacker with access to the affected endpoint could inject SQL expressions into the underlying MySQL query. Although the injection occurs in an `ORDER BY` context, it is sufficient to enable blind SQL injection techniques that can disclose database information through conditional expressions that affect result ordering. Crafted expressions may also cause excessive computation or query failures, potentially leading to degraded performance or denial of service. No direct evidence of reliable data modification or stacked query execution was demonstrated. Version 4.80.1 fixes the issue. If an immediate upgrade is not possible, users should restrict access to the affected endpoint to trusted roles only and ensure that any user-supplied sort or column parameters are strictly allow-listed at the application or proxy layer.

• CWE-89

• https://github.com/fleetdm/fleet/security/advisories/GHSA-49xw-vfc4-7p43Vendor Advisory

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26180Heap-based buffer overflow in Windows Kernel allows an autho…7.8
• CVE-2026-26181Use after free in Microsoft Brokering File System allows an …7.8
• CVE-2026-26182Use after free in Windows Ancillary Function Driver for WinS…7
• CVE-2026-26183Improper access control in Windows RPC API allows an authori…7.8
• CVE-2026-26184Buffer over-read in Windows Projected File System allows an …7.8
• CVE-2026-26185Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2026-26187lakeFS is an open-source tool that transforms object storage…8.1
• CVE-2026-26188Solspace Freeform plugin for Craft CMS 5.x is a super flexib…5.4
• CVE-2026-26189Trivy Action runs Trivy as GitHub action to scan a Docker co…8.1
• CVE-2026-2619GitLab has remediated an issue in GitLab EE affecting all ve…4.3
• CVE-2026-26190Milvus is an open-source vector database built for generativ…9.8
• CVE-2026-26191Fleet is open source device management software. Prior to ve…9.8