CVE-2026-54245: Fleet SQL injection in Okta conditional access endpoint

CVE-2026-54245 · Severity: high · CVSS 4 · Published 2026-08-26

Fleet is a device management platform that organizations use to monitor and manage computers across their fleets. When integrated with Okta conditional access, a critical design flaw allows an attacker who controls any enrolled host to inject SQL commands through a database query. This can lead to theft of administrator credentials and session tokens, which an attacker can then use to gain complete control of the Fleet management system and run malicious commands on all enrolled devices.

Technologies: github.com/fleetdm/fleet (Go), github.com/fleetdm/fleet/v4 (Go). Vendors: Go.

Quick answers

Is CVE-2026-54245 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54245 being exploited in the wild.
How severe is CVE-2026-54245?
High severity, with a CVSS score of 4, published 26 August 2026.
Which products and versions are affected?
github.com/fleetdm/fleet (Go) < 4.86.2, SEMVER:introduced=0,fixed=4.86.2; github.com/fleetdm/fleet/v4 (Go) SEMVER:introduced=0,fixed=4.86.2.
Is there a fix for CVE-2026-54245?
Yes. github.com/fleetdm/fleet (Go): upgrade to 4.86.2 or later; github.com/fleetdm/fleet/v4 (Go): upgrade to 4.86.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54245 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-54245?
Check whether you run github.com/fleetdm/fleet (Go) or github.com/fleetdm/fleet/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/fleetdm/fleet (Go): upgrade to 4.86.2 or later
    go get github.com/fleetdm/fleet@v4.86.2
  • github.com/fleetdm/fleet/v4 (Go): upgrade to 4.86.2 or later
    go get github.com/fleetdm/fleet/v4@v4.86.2

Technical details

The vulnerability is a SQL injection (CWE-89) in the Okta conditional access integration endpoint. The vulnerable code uses a host-supplied value in a database query without proper parameterization or prepared statements. Because the value is reported by the host's own agent and stored verbatim, any attacker with control over a single enrolled host (the lowest-privilege role in Fleet) can craft a malicious payload to break out of the intended query and execute arbitrary SQL. Attack vector is network-based and requires only low privileges (enrollment as a host). The attack is unauthenticated from the attacker's perspective because the endpoint itself processes host-provided data without authentication. Successful exploitation enables disclosure of arbitrary database contents (high confidentiality impact) and modification of database records (high integrity impact). The vulnerability affects Fleet Premium versions prior to 4.86.2; Fleet versions without Okta conditional access enabled are not affected. A patch is available in version 4.86.2.

Affected products

  • Fleet Fleet < 4.86.2

Identifiers

  • CVE-2026-54245
  • GHSA-7q96-f8xw-jv5j
  • GO-2026-6264

Timeline

  • 2026-08-11: disclosed
  • 2026-08-11: patched: Version 4.86.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.