Advisoriesby IbisOktaCVE-2026-78545
Okta Access Gateway: code injection
Fix: upgrade to 2026.9.1 or later
The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Okta Access Gateway Product | < 2026.9.1 | 2026.9.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-94