CVE-2026-78545

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.

CVSS v3 6.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*

History

29 Sep 2026, 20:19

Type	Values Removed	Values Added
References	~~() https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545/ -~~	() https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545/ - Vendor Advisory
CPE		cpe:2.3:a:okta:access_gateway::::::::
First Time		Okta access Gateway Okta

Information

Published : 2026-09-08 20:18

Updated : 2026-09-29 20:19

NVD link : CVE-2026-78545

Mitre link : CVE-2026-78545

CVE.ORG link : CVE-2026-78545

JSON object : View

Products Affected

okta

access_gateway

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-78545", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78545", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-10T18:00:45.406892Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@okta.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "psirt@okta.com", "affectedData": [{"vendor": "Okta", "product": "Okta Access Gateway", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-08T20:18:35.727", "references": [{"url": "https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545/", "tags": ["Vendor Advisory"], "source": "psirt@okta.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@okta.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives."}], "lastModified": "2026-09-29T20:19:22.983", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C169A22F-2C3D-40B8-B3E7-1EEEAE47D950", "versionEndExcluding": "2026.9.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@okta.com"}