CVE-2026-26186
Published: 26 February 2026
Summary
CVE-2026-26186 is a high-severity SQL Injection (CWE-89) vulnerability in Fleetdm Fleet. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of user-supplied inputs like the order_key query parameter to block SQL injection attempts in the ORDER BY clause.
SI-2 ensures timely remediation of flaws such as CVE-2026-26186 by applying patches like version 4.80.1 to eliminate the unsafe goqu.I() usage.
SI-9 enforces strict allow-listing of user-supplied sort parameters at application or proxy boundaries to prevent injection via untrusted order_key values.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in network-accessible Fleet web/API endpoint directly enables T1190 (Exploit Public-Facing Application) for data disclosure or DoS via crafted ORDER BY input.
NVD Description
Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the `order_key` query parameter. Due to unsafe use of `goqu.I()` when constructing the `ORDER BY`…
more
clause, specially crafted input could escape identifier quoting and be interpreted as executable SQL. An authenticated attacker with access to the affected endpoint could inject SQL expressions into the underlying MySQL query. Although the injection occurs in an `ORDER BY` context, it is sufficient to enable blind SQL injection techniques that can disclose database information through conditional expressions that affect result ordering. Crafted expressions may also cause excessive computation or query failures, potentially leading to degraded performance or denial of service. No direct evidence of reliable data modification or stacked query execution was demonstrated. Version 4.80.1 fixes the issue. If an immediate upgrade is not possible, users should restrict access to the affected endpoint to trusted roles only and ensure that any user-supplied sort or column parameters are strictly allow-listed at the application or proxy layer.
Deeper analysisAI
CVE-2026-26186 is a SQL injection vulnerability affecting Fleet, an open source device management software. The flaw exists in versions prior to 4.80.1 and stems from the unsafe use of the `goqu.I()` function when constructing the `ORDER BY` clause, allowing authenticated users to inject arbitrary SQL expressions via the `order_key` query parameter. This enables specially crafted input to escape identifier quoting and be interpreted as executable SQL in the underlying MySQL query.
An authenticated attacker with access to the affected endpoint can exploit this vulnerability over the network with low complexity and no user interaction required. Although the injection occurs in an `ORDER BY` context, it supports blind SQL injection techniques to disclose database information through conditional expressions that influence result ordering. Attackers may also trigger excessive computation or query failures, leading to degraded performance or denial of service. The CVSS v3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with no demonstrated reliable data modification or stacked query execution, and it maps to CWE-89.
The advisory recommends upgrading to version 4.80.1, which fixes the issue. If immediate upgrading is not feasible, restrict access to the affected endpoint to trusted roles only and strictly allow-list any user-supplied sort or column parameters at the application or proxy layer. Further details are available in the GitHub Security Advisory at https://github.com/fleetdm/fleet/security/advisories/GHSA-49xw-vfc4-7p43.
Details
- CWE(s)