CVE-2026-26186: 
NixOS vulnerability analysis and mitigation

CVE-2026-26186 is a SQL injection vulnerability in Fleet, an open-source device management platform, affecting all versions prior to 4.80.1. The flaw resides in the software versions API, where the order_key query parameter is processed using goqu.I() without adequate sanitization, allowing authenticated users to inject arbitrary SQL into ORDER BY clauses. It was disclosed on February 25–26, 2026, via a GitHub Security Advisory (GHSA-49xw-vfc4-7p43). The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Fleet Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically arising from Fleet's use of goqu.I() to construct the ORDER BY clause in its MySQL queries. The goqu.I() function is intended to quote SQL identifiers (e.g., column names), but specially crafted input containing backtick characters can escape the identifier quoting mechanism, causing the input to be interpreted as executable SQL rather than a literal identifier. An authenticated attacker can supply a malicious value to the order_key query parameter of the software versions API endpoint, injecting conditional SQL expressions that enable blind SQL injection — for example, using time-based or boolean-based techniques to infer database contents through observable differences in result ordering (GitHub Advisory, Fleet Advisory).

An authenticated attacker exploiting this vulnerability can perform blind SQL injection against Fleet's underlying MySQL database, potentially disclosing sensitive device management data, user credentials, or configuration information stored in the database. While no direct evidence of reliable data modification or stacked query execution was demonstrated, crafted expressions can cause excessive computation or query failures, leading to degraded performance or denial of service. The scope is limited to the vulnerable Fleet system itself, with no demonstrated impact on subsequent systems (GitHub Advisory, Fleet Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The vulnerability requires authentication (low privileges), making opportunistic mass exploitation less likely. The EPSS score is approximately 0.045% (19th percentile), indicating a low near-term exploitation probability. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue was responsibly disclosed by researcher @fuzzztf (Fleet Advisory).

1. Authentication: Obtain valid credentials for a Fleet instance running a version prior to 4.80.1 — any authenticated user role with access to the software versions API endpoint is sufficient.
2. Identify the vulnerable endpoint: Locate the Fleet software versions API endpoint (e.g., /api/v1/fleet/software/versions) that accepts the order_key query parameter for sorting results.
3. Craft a malicious order_key payload: Construct a value that escapes the backtick identifier quoting used by goqu.I(), such as a payload like `column_name` DESC, (CASE WHEN (1=1) THEN column_a ELSE column_b END) to inject a conditional expression into the ORDER BY clause.
4. Perform blind SQL injection: Use boolean-based or time-based blind injection techniques — e.g., injecting (CASE WHEN (SELECT SUBSTRING(password,1,1) FROM users LIMIT 1)='a' THEN name ELSE version END) — and observe differences in result ordering to infer database contents one character at a time.
5. Automate extraction: Use tools such as sqlmap with a captured authenticated request to automate the blind injection process and extract database schema, table contents, or credentials.
6. Optionally cause DoS: Inject computationally expensive expressions (e.g., heavy subqueries or sleep functions if supported) to degrade Fleet server performance (GitHub Advisory, Fleet Advisory).

• Network: Unusual or repeated HTTP GET/POST requests to Fleet's software versions API endpoint (e.g., /api/v1/fleet/software/versions) with anomalous or lengthy order_key parameter values containing SQL keywords, backticks, CASE, WHEN, SELECT, or SLEEP.
• Logs: Fleet application logs showing query errors, unexpected ORDER BY clause failures, or MySQL syntax errors originating from the software versions API; elevated query execution times suggesting time-based blind injection attempts.
• Logs: Authentication logs showing a single user account making a high volume of requests to the software versions endpoint in rapid succession, consistent with automated injection tooling.
• Database: MySQL slow query logs showing unusually complex or long-running ORDER BY queries against Fleet's software-related tables.

Fleet has released version 4.80.1, which fixes the vulnerability by properly sanitizing the order_key parameter and preventing unsafe use of goqu.I() in ORDER BY clause construction (GitHub Advisory). Organizations should upgrade to Fleet v4.80.1 or later as the primary remediation step. If an immediate upgrade is not feasible, restrict access to the affected software versions API endpoint to trusted roles only, and implement strict allow-listing of permitted order_key values at the application or reverse proxy layer to block arbitrary input (Fleet Advisory).

The vulnerability was responsibly reported by security researcher @fuzzztf and acknowledged by the Fleet team in the official GitHub Security Advisory. Fleet published the advisory under the handle lukeheath and provided contact details (security@fleetdm.com) for follow-up questions. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified (Fleet Advisory).