{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fleet-premium--4.86.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Fleet Premium (\u003c 4.86.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Fleet"],"content_html":"\u003cp\u003eFleet Premium versions prior to 4.86.2 contain a critical SQL injection vulnerability (CVE-2026-54245) within the Okta conditional access integration. The vulnerability arises because a host-supplied value, reported by the osquery agent during the conditional access check, is processed by the database query without sufficient parameterization or sanitization. Because an attacker who controls a single enrolled host can manipulate the data reported by that agent, they can inject malicious SQL commands. This flaw allows an attacker to query or modify the Fleet database, enabling the extraction of global administrator session tokens. Once a session token is retrieved, an attacker can impersonate a global administrator and leverage the product's administrative features to deploy malicious scripts to any enrolled host, effectively achieving remote code execution across the managed environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability affects organizations utilizing Fleet Premium with the Okta conditional access integration enabled. Successful exploitation poses a high risk to the confidentiality and integrity of the Fleet management database and the availability and security of all enrolled endpoints. Attackers can gain global administrator privileges, which facilitates unauthorized access to sensitive host data, execution of arbitrary commands via osquery, and long-term persistence within the managed fleet infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Fleet Premium to version 4.86.2 or higher immediately to patch CVE-2026-54245.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, disable the Okta conditional access integration in the Fleet configuration until the environment can be updated.\u003c/li\u003e\n\u003cli\u003eAudit administrative session logs and system logs for unusual queries or unauthorized global administrator activity coinciding with known enrolments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T19:13:22Z","date_published":"2026-08-20T19:13:22Z","id":"https://feed.craftedsignal.io/briefs/2026-08-fleet-sql-injection/","summary":"A SQL injection vulnerability in the Fleet Premium Okta conditional access integration allows an enrolled host to execute arbitrary database queries, leading to privilege escalation and potential remote code execution.","title":"SQL Injection in Fleet Premium Okta Integration","url":"https://feed.craftedsignal.io/briefs/2026-08-fleet-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Fleet Premium (\u003c 4.86.2)","version":"https://jsonfeed.org/version/1.1"}