CVE-2026-54245: Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

August 20, 2026 (updated September 6, 2026)

A SQL injection vulnerability in Fleet’s Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global administrator, which on a managed fleet leads to remote code execution on enrolled hosts.

References

github.com/advisories/GHSA-7q96-f8xw-jv5j
github.com/fleetdm/fleet/releases/tag/fleet-v4.86.2
github.com/fleetdm/fleet/security/advisories/GHSA-7q96-f8xw-jv5j
nvd.nist.gov/vuln/detail/CVE-2026-54245

Code Behaviors & Features

Detect and mitigate CVE-2026-54245 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →