Fleet CVE-2026-54245: One Host Can Open a Path to the Entire Fleet
SQL injection in Fleet's Okta integration and predictable iOS package URLs expose two endpoint-management trust boundary failures.
- AUTHOR
- Karol Rapacz / CEO Breachroad · OSCP · PNPT
- PUBLISHED
- 20 August 2026
- READING TIME
- 17 min read
- TOPIC
- Vulnerabilities and CVEs
GitHub’s Advisory Database published and reviewed two important Fleet project notices on 20 August. The more severe, CVE-2026-54245, is SQL injection in Okta Conditional Access integration. An attacker controlling one enrolled host can read or change Fleet database contents, recover a global-administrator session token and then use the legitimate script feature against managed endpoints. A second issue exposes in-house iOS packages through predictable identifiers.
The findings differ in severity but share one lesson: an endpoint-management agent and enrolled device are not trusted input simply because enrolment succeeded. A host may be compromised, a local user may be an administrator, and every agent-reported value must cross a hostile-input boundary.
From one host-controlled value to global administration
CVE-2026-54245 affects Fleet Premium when Okta Conditional Access is configured. A path supporting that integration uses a host-supplied value in a database query without proper parameterisation. Because the agent’s value is stored verbatim, anyone controlling one enrolled host—the lowest-privilege role in the product—can influence the query.
Fleet says successful exploitation can disclose arbitrary database contents, including credentials and session tokens. A recovered global-admin token may be replayed, and global admins can execute scripts on enrolled hosts. The chain is therefore: low-trust endpoint → control-plane database → privileged session → legitimate remote execution across the fleet.
The CVSS 4.0 score is 7.6. That number can look modest beside the organisational impact because exploitation requires an enrolled host and one specific Okta configuration. In a fleet containing thousands of laptops, control of one endpoint is not an exotic assumption. EDR and MDM exist precisely because devices can be lost.
Affected and fixed versions
Fleet marks releases before 4.86.2 as affected by CVE-2026-54245. Version 4.86.2 contains the fix. An instance without Okta Conditional Access does not expose this path, but that is not a reason to leave a vulnerable build in place where configuration may change or is not fully understood.
If an immediate upgrade is impossible, the vendor recommends disabling Okta Conditional Access until the patched version is deployed. Coordinate that decision with IAM. Removing a vulnerable integration must not silently weaken a separate access policy.
A confused trust boundary
An agent must report posture data so the control plane can make an access decision. That data must never alter SQL structure. Parameterised statements separate data from code, while schema validation, length limits and object-level authorisation constrain meaning. Even a safely parameterised identifier should not let one host reference data belonging to another.
Architecturally, separate endpoint telemetry, conditional-access decisions and administrator sessions. When all three share a broadly readable store, one query flaw has a larger blast radius. Session tokens should be short-lived and stored so a database read does not immediately provide a replayable credential.
Predictable URLs for in-house iOS packages
Fleet also disclosed an enterprise-tier issue in endpoints serving IPA packages and manifests. Apple’s InstallEnterpriseApplication command requires a URL reachable by a managed device without a Fleet session. Fleet’s older MDM installer used a random, hard-to-guess token. The later in-house application endpoints did not yet use the same mitigation and exposed sequential title identifiers.
An unauthenticated party able to reach the Fleet server could guess identifiers and retrieve IPA files plus bundle identifier, version and name. The advisory describes read-only disclosure, without privilege escalation, write access or impact on unmanaged hosts. The fix is in Fleet 4.87.0.
An application binary can still be valuable reconnaissance. It may reveal API locations, feature flags, test certificates, environment names, business logic or diagnostic data. Secrets should never live in a client application, but disclosure still reduces an attacker’s research cost. Fleet recommends restricting network access, removing packages containing sensitive material and using signed, time-limited CloudFront URLs where available.
Upgrading without losing fleet control
Record the Fleet version, edition, Okta configuration, host count, external URL and iOS distribution path. Back up the database according to product guidance and test restoration. Review releases between current and target versions for schema migrations and compatibility across fleetd, osquery, reverse proxies and SSO.
Moving to at least 4.87.0 includes both fixes. A large deployment should use staging with representative configuration and synthetic devices. Test enrolment, check-in, queries, software installation, conditional access, admin login, scripts and iOS rollback. Do not test SQL injection or replay another user’s token in production.
If changes are split, 4.86.2 addresses CVE-2026-54245 and 4.87.0 addresses iOS URL protection. The final target should nevertheless be a currently supported release, not merely the minimum version named in an advisory.
Hunting and incident response
Review Conditional Access endpoint logs for unusual values, SQL errors, unexpectedly large responses and requests from hosts whose posture changed. Search database and application logs for new global-admin sessions, session reuse from a different address, bulk reads and scripts without a change ticket. Correlate actions with administrator identity, time and source host.
If evidence shows token disclosure, patching closes the vulnerability but does not invalidate the stolen session. Revoke active administrative sessions, force reauthentication, rotate affected integration credentials and investigate scripts sent during the exposure window. The originating endpoint requires EDR triage and a decision about re-enrolment.
For IPA disclosure, inspect access logs for sequential requests and downloads from addresses that are not managed devices. Determine which application versions were reachable and what they contained. A download alone does not prove code execution inside the organisation.
Long-term controls
Agent telemetry needs contract validation and must never construct SQL fragments. Security modelling should include a hostile enrolled host as a distinct actor. Administrator sessions need short lifetime, MFA, device binding and alerts for changes in geography or user agent.
A publicly reachable software URL should be a high-entropy capability with a short lifetime and, when possible, device binding. Reverse-proxy rate limits can slow enumeration, but they do not replace an unpredictable token.
Project facts and Breachroad conclusions
Okta conditions, SQLi impact, versions 4.86.2 and 4.87.0, IPA behaviour and workarounds come from Fleet advisories. The project does not report active exploitation. Session-store separation, hostile-host testing, hunting and revocation guidance are Breachroad analysis.
Cybersecurity training helps endpoint, IAM and SOC teams rehearse this chain. An IT security audit can validate Fleet configuration, privileged sessions, server exposure and upgrade evidence.
