GHSA-49xw-vfc4-7p43
NoneCVSS
—
EPSS
—
Published
Feb 26, 2026
CISA due date
—
The record
Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/fleetdm/fleet/v4 | 0 | 4.80.1 |
Related vulnerabilities
- CVE-2026-26186 Fleet is open source device management software. Same vulnerability
- GHSA-2v6m-6xw3-6467 Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users Also affects github.com/fleetdm/fleet/v4
- GHSA-5jvp-m9h4-253h Fleet: Authorization Bypass in certificate template batch deletion for team administrators Also affects github.com/fleetdm/fleet/v4
- GHSA-9pm7-6g36-6j78 Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint Also affects github.com/fleetdm/fleet/v4
- GHSA-ppwx-5jq7-px2w Fleet: Device lock PIN can be predicted if lock time is known Also affects github.com/fleetdm/fleet/v4
- CVE-2026-23999 Fleet is open source device management software. Also affects github.com/fleetdm/fleet/v4
- CVE-2026-24004 Fleet is open source device management software. Also affects github.com/fleetdm/fleet/v4
- CVE-2026-25963 Fleet is open source device management software. Also affects github.com/fleetdm/fleet/v4