highCVE-2026-54245Aug 20, 2026

CVE-2026-54245: Fleet SQL Injection in Okta Conditional Access Endpoint

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A flaw in Fleet's Okta conditional access integration lets anyone who controls a single enrolled host inject SQL into the Fleet database, potentially leaking session tokens that can be replayed for…

Packagegithub.com/fleetdm/fleet
Ecosystemgo
Affected< 4.86.2
Fixed in4.86.2
CVE-2026-54245: Fleet SQL Injection in Okta Conditional Access Endpoint

The problem

Fleet Premium's Okta conditional access flow exposes the endpoint /api/fleet/conditional_access/idp/sso. When Okta redirects authentication through the mTLS proxy, the proxy forwards the client certificate serial number to Fleet via an HTTP header (e.g., X-Client-Cert-Serial).

Fleet used that value directly in a database query with no parameterization.

Because the SCEP certificate serial is stored verbatim by the Fleet agent on the host, any party controlling one enrolled host can craft any serial value they choose. Successful exploitation can read or modify arbitrary rows in the Fleet MySQL database, including stored session tokens.

A disclosed session token can be replayed to gain global administrator access, which enables remote script execution on all enrolled hosts.

Proof of concept

A working proof-of-concept for CVE-2026-54245 in github.com/fleetdm/fleet, with the exact payload below.

http
POST /api/fleet/conditional_access/idp/sso HTTP/1.1
Host: okta.fleet.example.com
Content-Type: application/x-www-form-urlencoded
X-Client-Cert-Serial: 1' UNION SELECT session_key,2,3,4,5 FROM sessions-- -

SAMLRequest=...&RelayState=...

The mTLS proxy forwards the certificate serial number as a plain string header. Before the fix, Fleet's datastore layer interpolated this value directly into a SQL WHERE clause (e.g., WHERE cert_serial = '<value>'), giving an attacker full SQL injection primitives via a UNION SELECT or boolean-blind attack.

The patch replaced the string interpolation with a parameterized query placeholder (? bound argument), so the serial value is treated as data and never parsed as SQL. The root cause is CWE-89: Improper Neutralization of Special Elements in an SQL Command.

The fix

Upgrade Fleet to version 4.86.2 or later, which uses a parameterized query for the cert serial lookup. If an immediate upgrade is not possible, disable the Okta conditional access integration under Settings > Integrations > Conditional access until the patched version is deployed.

Reported by fuzzztf.

References: [1][2][3]

Related research