CVE-2026-54245
Received Received - Intake

SQL Injection in Fleet Okta Conditional Access

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description
Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database. The value is reported by the host's own agent and stored verbatim, then used on an unauthenticated request path that supports the conditional access integration, so any party controlling one enrolled host, the lowest-privilege position in the product, can influence the query. By disclosing arbitrary database contents an attacker can extract stored session tokens and replay them to act as a global administrator, and on a managed fleet that administrator access enables running scripts on enrolled hosts, leading to remote code execution. The issue requires Fleet Premium with the Okta conditional access integration enabled and does not affect instances where it is not configured. This issue is fixed in version 4.86.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-54245

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fleet fleet 4.86.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54245 is a SQL injection vulnerability in Fleet, an open-source device management platform. It affects versions prior to 4.86.2 and specifically involves the Okta conditional access integration in Fleet Premium. An attacker controlling an enrolled host can inject malicious SQL queries through a host-supplied value used in database queries without proper parameterization.

Detection Guidance

Check if your Fleet instance is running a version prior to 4.86.2. Verify if Okta conditional access integration is enabled. Inspect database queries for unparameterized host-supplied values in the integration path.

Impact Analysis

This vulnerability allows an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database. They can extract stored session tokens and replay them to gain global administrator access. With admin access, they can run scripts on enrolled hosts, leading to remote code execution.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data stored in the Fleet database, such as session tokens or host information. If exploited, it may result in a data breach, which could violate compliance requirements under GDPR (e.g., unauthorized data access or processing) and HIPAA (e.g., unauthorized access to protected health information).

Mitigation Strategies

Upgrade Fleet to version 4.86.2 or later immediately. Disable the Okta conditional access integration if not required. Review database access logs for suspicious queries or unauthorized data access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54245. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart