SQL Injection in Fleet Premium Okta Integration

Fleet Premium versions prior to 4.86.2 contain a critical SQL injection vulnerability (CVE-2026-54245) within the Okta conditional access integration. The vulnerability arises because a host-supplied value, reported by the osquery agent during the conditional access check, is processed by the database query without sufficient parameterization or sanitization. Because an attacker who controls a single enrolled host can manipulate the data reported by that agent, they can inject malicious SQL commands. This flaw allows an attacker to query or modify the Fleet database, enabling the extraction of global administrator session tokens. Once a session token is retrieved, an attacker can impersonate a global administrator and leverage the product's administrative features to deploy malicious scripts to any enrolled host, effectively achieving remote code execution across the managed environment.

Impact

The vulnerability affects organizations utilizing Fleet Premium with the Okta conditional access integration enabled. Successful exploitation poses a high risk to the confidentiality and integrity of the Fleet management database and the availability and security of all enrolled endpoints. Attackers can gain global administrator privileges, which facilitates unauthorized access to sensitive host data, execution of arbitrary commands via osquery, and long-term persistence within the managed fleet infrastructure.

Recommendation

• Upgrade all instances of Fleet Premium to version 4.86.2 or higher immediately to patch CVE-2026-54245.
• If upgrading is not immediately possible, disable the Okta conditional access integration in the Fleet configuration until the environment can be updated.
• Audit administrative session logs and system logs for unusual queries or unauthorized global administrator activity coinciding with known enrolments.