Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling CVE-2026-78620 - Sep 8, 2026
Description
The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.
Affected product and versions
Customers using Okta Access Gateway appliance versions prior to 2026.9.1 are affected.
Preconditions
This applies if the following preconditions are present:
Network access with authenticated administrative privileges, or local host access to the appliance’s event pipeline directory /opt/oag/events.
Customer Recommendations
To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.
Resolution
The vulnerability is present in Okta Access Gateway appliance versions prior to 2026.9.1 and is resolved in version 2026.9.1.
CVE details
CVE ID | |
Published Date | 2026-09-08 |
Vulnerability Type | Arbitrary File Write |
CWE | CWE-73 – External Control of File Name or Path |
CVSS v3 | Score: 5.9 Vector string: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N |