Improper Input Sanitization in Okta Access Gateway Application Label Configuration CVE-2026-78545 - Sep 8, 2026
Description
The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.
Affected product and versions
Customers using Okta Access Gateway appliance versions prior to 2026.9.1 are affected.
Preconditions
This applies if the following preconditions are present:
An authenticated user holds administrator privileges,
The administrator has access to the application create or update functionality.
Customer Recommendations
To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.
Resolution
The vulnerability is present in Okta Access Gateway appliance versions prior to 2026.9.1 and is resolved in version 2026.9.1.
CVE details
CVE ID | |
Published Date | 2026-09-08 |
Vulnerability Type | Code Injection |
CWE | CWE-94 Improper Control of Generation of Code |
CVSS v3 | Score: 6.6 Vector string: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |