CVE-2026-63378: TAKO AI Agent for Okta: Authenticated Python execution through validator bypass

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid fctrsession cookie can submit arbitrary Python source in the scriptcode field of POST /api/react/execute-script, without administrator privilege. In src/api/routers/reactstream.py, the source is stored with skipdiscovery=True, bypassing AI-based content filtering, and is passed to validategeneratedcode in src/utils/securityconfig.py. BLOCKEDPATTERNS recognizes direct import calls but misses the import name passed as a string, getattr is in ALLOWEDBUILTINS, and the AST checker handles ast.Name and ast.Attribute targets but fails to handle ast.Call targets. Dynamic getattr call chains through builtins therefore evade validation. The writetempscript helper writes the accepted code to disk, and asyncio.createsubprocessexec() executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through GET /api/react/stream-react-updates?processid=<id>. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.