Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation CVE-2026-78579 - Sep 8, 2026
Description
The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic.
Affected product and versions
Customers using Okta Access Gateway appliance versions prior to 2026.9.1 are affected.
Preconditions
This applies if the following preconditions are present:
The administrator has configured an LDAP datastore with a search filter template that references one or more SAML assertion attributes using the interpolation syntax,
The SAML attribute referenced in the filter template contains an externally influenced value.
Customer Recommendations
To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.
Resolution
The vulnerability is present in Okta Access Gateway appliance versions prior to 2026.9.1 and is resolved in version 2026.9.1.
CVE details
CVE ID | |
Published Date | 2026-09-08 |
Vulnerability Type | LDAP Injection |
CWE | CWE-90 – Improper Neutralization of Special Elements used in an LDAP Query |
CVSS v3 | Score: 6.8 Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |