Executive brief
Fleet is a device management platform that organizations use to monitor and manage computers across their fleets. When integrated with Okta conditional access, a critical design flaw allows an attacker who controls any enrolled host to inject SQL commands through a database query. This can lead to theft of administrator credentials and session tokens, which an attacker can then use to gain complete control of the Fleet management system and run malicious commands on all enrolled devices.
Technical details
The vulnerability is a SQL injection (CWE-89) in the Okta conditional access integration endpoint. The vulnerable code uses a host-supplied value in a database query without proper parameterization or prepared statements. Because the value is reported by the host's own agent and stored verbatim, any attacker with control over a single enrolled host (the lowest-privilege role in Fleet) can craft a malicious payload to break out of the intended query and execute arbitrary SQL. Attack vector is network-based and requires only low privileges (enrollment as a host). The attack is unauthenticated from the attacker's perspective because the endpoint itself processes host-provided data without authentication. Successful exploitation enables disclosure of arbitrary database contents (high confidentiality impact) and modification of database records (high integrity impact). The vulnerability affects Fleet Premium versions prior to 4.86.2; Fleet versions without Okta conditional access enabled are not affected. A patch is available in version 4.86.2.
Affected products
- Fleet Fleet < 4.86.2
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Version 4.86.2 released