Detections
Analytics

SCA: security update for github.com/fleetdm/fleet (GHSA-7q96-f8xw-jv5j)

high Tenable Cloud Security Plugin ID 446171

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta
 conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied
 value that is used in a database query without proper parameterization, allowing an attacker who controls
 a single enrolled host to read or modify arbitrary data in the Fleet database. The value is reported by
 the host's own agent and stored verbatim, then used on an unauthenticated request path that supports the
 conditional access integration, so any party controlling one enrolled host, the lowest-privilege position
 in the product, can influence the query. By disclosing arbitrary database contents an attacker can extract
 stored session tokens and replay them to act as a global administrator, and on a managed fleet that
 administrator access enables running scripts on enrolled hosts, leading to remote code execution. The
 issue requires Fleet Premium with the Okta conditional access integration enabled and does not affect
 instances where it is not configured. This issue is fixed in version 4.86.2. (CVE-2026-54245)

Solution

Update the github.com/fleetdm/fleet library and its related packages to version 4.86.2 or later.

See Also

https://github.com/advisories/GHSA-7q96-f8xw-jv5j

Plugin Details

Severity: High

ID: 446171

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 8/20/2026

Updated: 8/27/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-54245

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.6

Threat Score: 4.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/20/2026

Vulnerability Publication Date: 8/20/2026

Reference Information

CVE: CVE-2026-54245

cwe: CWE-89