AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OktaCVE-2026-78620

The Okta Access Gateway Kerberos configuration handler does not validate file...

Okta

CVE-2026-78620 · Published Sep 8, 2026 · updated Sep 22, 2026

Medium5.9
Fix: upgrade to 2026.9.1 or later
Okta advisory

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.

Affected versions

PackageAffectedFixed in
Okta Access Gateway
Product
< 2026.9.12026.9.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-73

More Okta advisories

All Okta
Medium 6.7Sep 8Okta Auth0 AD/LDAP Connector: missing authenticationCVE-2026-85981no fix yetCritical 9.0Sep 8Okta Auth0 AD/LDAP Connector: cross-site scriptingCVE-2026-85982no fix yetHigh 7.8Sep 8Okta Auth0 AD/LDAP Connector: code executionCVE-2026-85983no fix yetMedium 6.5Sep 8The react-native-auth0 SDK's web platform implementation does not scope its...CVE-2026-84685fixed in 5.11.1Medium 6.0Sep 8Okta Verify for Windows: link followingCVE-2026-78622fixed in 7.0.0Medium 5.6Sep 8The Okta Hyperdrive agent plugin returns a success response without a signed...CVE-2026-78629fixed in 1.5.2