CVE-2026-54245: Fleet Device Management Platform SQLI Vulnerability

CVE-2026-54245 Overview

CVE-2026-54245 is a SQL injection vulnerability [CWE-89] in Fleet, an open-source device management platform built on osquery. The flaw exists in the Okta conditional access integration in Fleet Premium prior to version 4.86.2. A host-supplied value is used in a database query without proper parameterization on an unauthenticated request path. An attacker who controls a single enrolled host can read or modify arbitrary data in the Fleet database, extract stored session tokens, and replay them to gain global administrator access.

Critical Impact
Compromise of one enrolled host enables database exfiltration, administrator session token replay, and remote code execution across the managed fleet via administrator script execution.

Affected Products

Fleet Premium versions prior to 4.86.2 with Okta conditional access integration enabled
Fleet device management platform built on osquery
Deployments not configured with Okta conditional access are not affected

Discovery Timeline

2026-08-26 - CVE-2026-54245 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-54245

Vulnerability Analysis

The vulnerability resides in Fleet Premium's Okta conditional access integration. Fleet stores a value reported by the host's own agent verbatim, then uses that value in a database query without parameterization. The request path supporting the conditional access integration is unauthenticated, so the attacker does not need Fleet credentials.

Controlling one enrolled host, the lowest-privilege position available in the product, is sufficient to influence the query. An attacker who exfiltrates database contents can recover stored session tokens. Replaying those tokens grants global administrator access, and Fleet administrators can run arbitrary scripts on enrolled hosts. This escalation chain turns a single compromised endpoint into remote code execution across the fleet.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Host-supplied input is concatenated into a database query rather than passed as a bound parameter. Trust in agent-reported data on an unauthenticated endpoint compounds the flaw.

Attack Vector

The attack vector is network-based. The attacker configures the Fleet agent on a host they control to report a malicious value. That value reaches the unauthenticated conditional access request path and is executed against the Fleet database. The attacker then reads session token material, replays a valid administrator session, and issues script execution commands to enrolled hosts.

No synthetic exploitation code is provided. Refer to the GitHub Security Advisory GHSA-7q96-f8xw-jv5j for vendor technical details.

Detection Methods for CVE-2026-54245

Indicators of Compromise

Anomalous host-reported values on the Okta conditional access endpoint containing SQL syntax such as quotes, UNION, SELECT, or comment markers
Unexpected reads or writes against Fleet database tables that hold session tokens
Fleet administrator sessions originating from IP addresses or user agents not associated with legitimate administrators
Script execution jobs dispatched to enrolled hosts outside of normal change windows

Detection Strategies

Enable database query logging on the Fleet MySQL backend and alert on syntactically anomalous statements originating from the conditional access code path
Correlate Fleet audit logs for administrator actions against known administrator identity sources and geolocation baselines
Inspect Fleet application logs for unauthenticated requests to the Okta conditional access endpoint carrying oversized or specially crafted host identifiers

Monitoring Recommendations

Monitor Fleet script execution telemetry and flag scripts pushed to enrolled hosts that were not authored through normal workflows
Alert on new session tokens issued to administrator accounts without a corresponding successful authentication event in Okta
Track outbound connections from Fleet-managed hosts to unrecognized command-and-control infrastructure following administrator activity

How to Mitigate CVE-2026-54245

Immediate Actions Required

Upgrade Fleet to version 4.86.2 or later, which contains the fix for CVE-2026-54245
Rotate all Fleet administrator session tokens and API tokens after upgrading
Audit Fleet administrator activity and script execution history for the period the vulnerable version was deployed
Review enrolled host inventory and investigate any host that reported malformed identifiers to the conditional access endpoint

Patch Information

The issue is fixed in Fleet version 4.86.2. Release details are available in the GitHub Fleet Release v4.86.2 notes and the GitHub Security Advisory GHSA-7q96-f8xw-jv5j.

Workarounds

Disable the Okta conditional access integration in Fleet Premium until the upgrade to 4.86.2 is complete
Restrict network access to the Fleet server so that only trusted, enrolled hosts can reach the conditional access endpoint
Reduce the population of enrolled hosts with elevated trust and re-enroll suspect devices after cleanup

bash

# Verify installed Fleet version and upgrade path
fleetctl --version
# Upgrade to the patched release
# Follow the official upgrade procedure documented at
# https://github.com/fleetdm/fleet/releases/tag/fleet-v4.86.2