CVE-2026-54245: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in fleetdm fleet

Fleet, an open-source device management platform, has an SQL injection vulnerability (CWE-89) in versions prior to 4.86.2 when Fleet Premium's Okta conditional access integration is enabled. The flaw is due to a host-supplied value being stored verbatim and used in an unauthenticated database query without proper parameterization. An attacker controlling a single enrolled host can exploit this to read or modify arbitrary database contents, including session tokens, enabling them to impersonate a global administrator. With administrator privileges, the attacker can run scripts on enrolled hosts, leading to remote code execution. The vulnerability requires the specific configuration of Fleet Premium with Okta conditional access and is fixed in version 4.86.2.

An attacker with control over a single enrolled host can exploit the SQL injection to read or modify arbitrary data in the Fleet database. This includes extracting session tokens, which can be replayed to gain global administrator privileges. With these privileges, the attacker can execute scripts on enrolled hosts, resulting in remote code execution. This elevates a low-privilege position to full administrative control, significantly compromising the managed fleet environment.

Upgrade Fleet to version 4.86.2 or later, where this SQL injection vulnerability is fixed. The vulnerability only affects Fleet Premium instances with the Okta conditional access integration enabled; disabling this integration mitigates the risk. There is no indication of a temporary workaround or partial fix. Patch status is not explicitly confirmed in the vendor advisory, but the fix is stated to be in version 4.86.2.