SQL Injection Risk in Fleet Device Management Platform by FleetDM
CVE-2026-54245

7.6HIGH

Key Information:

Vendor

Fleetdm

Status
Fleet
Vendor
CVE Published:
26 August 2026

What is CVE-2026-54245?

The device management platform, Fleet, has a susceptibility in its Okta conditional access integration, allowing SQL injection through user-provided values. In versions before 4.86.2, this vulnerability enables an attacker on a single enrolled host to execute arbitrary database queries without parameterization. This misconfiguration permits unauthorized access, which can lead to sensitive data exposure, including session tokens, and the potential for remote code execution. The issue is contained within Fleet Premium when the Okta integration is active and is resolved in version 4.86.2.

Affected Version(s)

fleet < 4.86.2

References

https://github.com/fleetdm/fleet/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/fleetdm/fleet/releases/tag/fleet-v4.86.2
x_refsource_MISC

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.