CVE-2026-54245

Executive Summary

CVE-2026-54245 is a critical SQL injection vulnerability in Fleet, an open-source device management platform built on osquery. The flaw exists in versions prior to 4.86.2 and specifically affects the Okta conditional access integration in Fleet Premium, allowing an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database. The vulnerability stems from a host-supplied value that is used in an unauthenticated database query without proper parameterization, which can be chained to extract stored session tokens, impersonate a global administrator, and execute remote code across the managed fleet.

Technical Analysis

Vulnerability Mechanism

The vulnerability is a classic SQL injection (CWE-89) residing in the Okta conditional access integration of Fleet Premium. The attack mechanism can be broken into the following components:

1. Attack Source — Host-Reported Data

Fleet is built on osquery, which allows enrolled hosts to report telemetry and status data back to the central management server. The vulnerable condition arises when a value reported by the host's own agent is stored "verbatim" and subsequently used in a database query. This design becomes dangerous because the value originates from a low-privilege entity (an enrolled host) and is treated as trusted input during query construction.

2. Unauthenticated Request Path

The value is not only stored—it is later consumed on an unauthenticated request path that supports the Okta conditional access integration. This is significant because it means the attacker does not need to authenticate to the Fleet server to trigger the vulnerable query. While the attacker must control an enrolled host, the actual exploitation occurs without additional authentication.

3. Lack of Parameterization

The NVD description explicitly states the value is used "in a database query without proper parameterization." This indicates the vulnerable code path constructs SQL statements via string concatenation rather than using parameterized queries or prepared statements. The absence of parameterization enables the injection of arbitrary SQL syntax into the query.

4. Impact on Database Integrity

Because the injected value can alter the structure of the SQL query, the attacker gains the ability to read or modify arbitrary data in the Fleet database. The database likely contains configuration data, host enrollment details, user accounts, and—critically—session tokens that enable administrative access.

Attack Surface

• Product: Fleet Premium (open-source core with premium features enabled)
• Integration: Okta conditional access — an identity-driven access control feature
• Privilege Requirement: Control of a single enrolled host (the lowest-privilege position in the product)
• Request Path: Unauthenticated — no prior authentication needed to reach the vulnerable query
• Non-Impacted Configurations: Instances where the Okta conditional access integration is not enabled

Code-Level Assessment

While the NVD description does not provide specific function names, class names, or URL endpoints, the vulnerability class is well understood. The vulnerable pattern likely resembles:

SELECT * FROM okta_conditional_access WHERE host_value = '<UNSANITIZED_HOST_INPUT>'

The absence of parameterization in this pattern permits an attacker to close the string context and append additional SQL clauses, such as UNION SELECT for data exfiltration or stacked queries for data modification.

Insufficient technical detail available: Specific endpoint paths, parameter names, and function identifiers are not provided in the NVD description and should not be assumed.

Exploitation Scenarios

Step 1: Reconnaissance / Target Identification

An attacker begins by identifying Fleet Premium instances with the Okta conditional access integration enabled. This can be achieved through:

• Shodan/Censys searches: Looking for exposed Fleet management endpoints (typically web-based dashboards on port 8080 or 8443)
• Banner/header analysis: Fleet often exposes identifying headers or API responses that reveal its version
• Behavioral observation: Detecting the presence of an Okta integration by observing login flows or conditional access prompts

The attacker must also have achieved the lowest-privilege position: control of a single enrolled host. This is typically a managed workstation or server that has the osquery agent installed and is connected to the Fleet server.

Step 2: Triggering the Flaw Class

Once the attacker controls an enrolled host, they manipulate the agent to report a malicious value in the field that feeds the Okta conditional access query. Because this value is stored verbatim, the attacker's payload persists in the database and is later executed when the unauthenticated conditional access request path processes it.

The attacker crafts a SQL injection payload designed to:

1. Terminate the original SQL statement's context
2. Append additional query clauses to enumerate database schema and extract data

Step 3: Payload Execution at the Vulnerability-Class Level

At the SQL injection class level, the payload execution follows a standard approach:

• Data exfiltration: UNION SELECT statements are used to combine the original query results with attacker-controlled queries that extract data from other database tables (users, sessions, configuration)
• Data modification: UPDATE or INSERT statements modify existing records (e.g., elevating a user's role, inserting a new admin account)
• Blind injection techniques: If error messages are not reflected in responses, boolean-based or time-based blind injection can still extract data character by character

Step 4: Post-Exploitation Impact

The attack chain escalates as follows:

1. Database disclosure: The attacker extracts stored session tokens from the database
2. Session replay: The stolen tokens are replayed against the Fleet web interface or API to authenticate as a global administrator
3. Global admin access: As an administrator, the attacker can modify fleet-wide settings, manage all enrolled hosts, and access sensitive configuration data
4. Remote code execution: Fleet's management capabilities allow administrators to run scripts on enrolled hosts. An attacker with global admin access can push scripts to any or all enrolled hosts, achieving remote code execution across the entire fleet
5. Persistence: The attacker maintains a foothold by injecting additional malicious script content that survives host reboots or agent updates

No public PoC is available for CVE-2026-54245; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

Business Impact

The vulnerability enables a complete compromise of the device management infrastructure:

• Confidentiality: An attacker can extract all data stored in the Fleet database, including:

  • User credentials and API tokens
  • Host enrollment secrets
  • Configuration data for managed devices
  • Session tokens for all users, including administrators

• Integrity: Database modification allows the attacker to:

  • Alter enrollment records
  • Modify user roles and permissions
  • Inject malicious configuration that persists across restarts

• Availability: While not the primary attack vector, SQL injection can be leveraged to:

  • Corrupt database records
  • Cause denial-of-service via resource-consuming queries
  • Disrupt the conditional access enforcement mechanism

• Lateral movement & RCE: The escalation to global administrator access enables script execution across all enrolled hosts, providing a direct path to remote code execution on every managed device.

Affected Systems

• Fleet Premium version 4.86.1 and earlier
• Only environments where the Okta conditional access integration is enabled
• The open-source Fleet core is affected only when the premium integration is activated

Blast Radius

The blast radius is enterprise-wide. Organizations using Fleet to manage device fleets of any size are at risk, with the severity scaling directly with the number of enrolled hosts. A single compromised host—the lowest-privilege entity—can lead to compromise of:

• The entire management plane
• Every enrolled endpoint
• Any connected systems accessible from those endpoints

CVSS Assessment

The NVD has not yet assigned a CVSS score for this vulnerability. However, based on the low privilege requirement (single enrolled host) and the catastrophic impact (RCE across the fleet), the eventual score is expected to be in the Critical range (9.0-10.0).

Detection Guidance

Sigma Rule

title: Fleet SQL Injection via Okta Conditional Access Endpoint
id: 8f4a2b6c-3d9e-4f1a-8c7b-2e5a9f1d4c3b
status: experimental
description: Detects SQL injection patterns in requests to Fleet's Okta conditional access integration endpoint
author: Valtersit Threat Intel Team
date: 2026/06/15
logsource:
  category: webserver
  product: fleet
  service: http
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query:
      - '*union*select*'
      - '*select*from*'
      - '*/**'
      - '*waitfor*delay*'
      - '*benchmark*'
      - '*sleep(*'
      - '*concat(*'
      - '*information_schema*'
      - '*0x*'
      - '*%27*'
      - '*%27or*'
      - '*%27and*'
  condition: selection
falsepositives:
  - Legitimate administrative queries containing similar keywords
  - URL encoding of legitimate values that include apostrophes
  - Security scanning tools
level: high
tags:
  - attack.t1190
  - attack.t1505.003
  - cve.2026.54245

YARA Rule

rule CVE_2026_54245_Fleet_SQLi
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects SQL injection payloads targeting Fleet Okta conditional access integration"
        cve = "CVE-2026-54245"
        date = "2026-06-15"
        severity = "Critical"

    strings:
        $s1 = "UNION SELECT" ascii nocase
        $s2 = "union select" ascii nocase
        $s3 = "information_schema" ascii nocase
        $s4 = "SELECT * FROM" ascii nocase
        $s5 = "OR 1=1" ascii nocase
        $s6 = "OR '1'='1" ascii nocase
        $s7 = "waitfor delay" ascii nocase
        $s8 = "pg_sleep" ascii nocase
        $s9 = "sleep(" ascii nocase
        $s10 = "concat(" ascii nocase
        $s11 = "into outfile" ascii nocase
        $s12 = "load_file" ascii nocase
        $s13 = "0x" ascii nocase
        $s14 = "char(" ascii nocase
        $s15 = "CONVERT(" ascii nocase
        $s16 = "CAST(" ascii nocase
        $s17 = "fleetdm" ascii nocase
        $s18 = "osquery" ascii nocase
        $s19 = "session_token" ascii nocase
        $s20 = "administrator" ascii nocase

    condition:
        uint16(0) == 0x0D0A or uint16(0) == 0x0A0D or uint32(0) == 0x0A0D0A0D or uint32(0) == 0x0D0A0D0A or filesize > 0KB
        and (any of ($s1-$s16)) and (any of ($s17-$s20))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-54245 Fleet SQL Injection via Okta Conditional Access"; 
sid:5424501; 
rev:1; 
metadata:author "Valtersit Threat Intel"; 
metadata:cve "CVE-2026-54245";
metadata:attack_tactic "T1190 Exploit Public-Facing Application";
flow:to_server,established; 
http.method; content:"GET"; http.method; content:"POST"; 
http.uri; content:"/"; 
http.uri; content:"okta"; nocase; 
http.uri; content:"cond"; nocase; 
http.uri; pcre:"/(union\s+select|select\s+.*\s+from|information_schema|sleep\s*\(|waitfor\s+delay|benchmark\s*\(|%\s*27|or\s+1\s*=\s*1)/i"; 
classtype:attempted-admin; 
reference:cve,2026-54245; 
threshold:type limit, track by_src, count 10, seconds 60)

Elastic Detection

// EQL detection for Fleet SQL injection attempts
sequence by source.ip with maxspan=5s
  [network where event.action == "connection" and destination.port == 8080]
  [http where http.request.method in ("GET", "POST") and 
   (http.request.uri contains "okta" or http.request.uri contains "cond") and
   (
     http.request.uri contains "union" or
     http.request.uri contains "select" or
     http.request.uri contains "information_schema" or
     http.request.uri contains "sleep(" or
     http.request.uri contains "waitfor" or
     http.request.uri contains "benchmark" or
     http.request.uri contains "%27" or
     http.request.uri contains "or 1=1" or
     http.request.uri contains "' or '" or
     http.request.uri contains "concat("
   )]

Splunk SPL Query

index=web access_logs OR index=proxy main
  (uri="/okta*" OR uri="/cond*" OR uri="*/auth*" OR uri="*/callback*")
  AND (
    uri IN ("*union*select*", "*select*from*", "*information_schema*", "*sleep(*", 
            "*waitfor*delay*", "*benchmark*", "*concat(*", "*%27*", "*or*1=1*")
  )
  OR (
    status=500 AND
    (message IN ("*sql*", "*syntax*", "*database*", "*query*", "*odbc*", "*mysql*"))
  )
| stats count by src_ip, uri, status, dest_host
| sort - count
| table _time, src_ip, dest_host, uri, status, count

Wazuh OSSEC Rule

<group name="fleet,">
  <rule id="100542" level="15">
    <decoded_as>json</decoded_as>
    <field name="url">\.*okta\.*</field>
    <description>Potential SQL injection in Fleet Okta conditional access path</description>
    <group>attack.t1190,cve-2026-54245,</group>
    <if_sid>001</if_sid>
    <match>union select|information_schema|sleep\(|waitfor|benchmark\(|%27|or 1=1|concat\(</match>
    <options>no_full_log</options>
  </rule>

  <rule id="100543" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.*okta\.*</field>
    <description>High volume of requests to Fleet Okta endpoint - possible scanning</description>
    <group>cve-2026-54245,</group>
    <if_sid>001</if_sid>
    <frequency>20</frequency>
    <timeframe>60</timeframe>
    <same_source_ip />
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

While the NVD description states that "this issue is fixed in version 4.86.2," our tracked sources have not yet validated or confirmed the availability of an official patch artifact. Organizations should treat this as a zero-day situation until the patch is verified.

1. Immediate Mitigations

2. Patch/Upgrade Steps

1. Verify patch availability: Check the Fleet GitHub repository (github.com/fleetdm/fleet) and official Fleet security advisories for the 4.86.2 release notes.
2. Test in staging: Deploy the patched version in an isolated staging environment that mirrors production configuration, including the Okta integration.
3. Upgrade all Fleet instances: Apply the upgrade to version 4.86.2 or later across all environments.
4. Validate the Okta integration: After upgrade, verify that conditional access still functions correctly and that no regression has occurred.
5. Monitor for re-exploitation: Even after patching, monitor logs for the indicators outlined in the Detection Guidance section.

3. Long-Term Hardening

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54245
2. Fleet GitHub Repository: https://github.com/fleetdm/fleet — Monitor for release notes and security advisory for version 4.86.2
3. Fleet Official Documentation: https://fleetdm.com/docs — Configuration guides for Okta conditional access integration
4. CWE-89 Reference: https://cwe.mitre.org/data/definitions/89.html — SQL Injection weakness class details
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-54245 is not currently listed. Monitor this catalog for updates.

Threat actor campaigns or exploit-in-the-wild evidence: No known threat actor campaigns have been attributed to this CVE. No exploit code or proof-of-concept has been publicly disclosed. The vulnerability's exploitation requires control of a single enrolled host, which is a low barrier in managed fleet environments, increasing the risk of eventual exploitation attempts.

Report generated: 2026-06-15
Threat intelligence provided by valtersit.com
Classification: UNCLASSIFIED / TLP:CLEAR