CVE-2026-78545: Improper Input Sanitization in Okta Access Gateway Application Label Configuration
Published Sep 8, 2026
·Updated
The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.
Affected Software
1 affected component
Okta Okta Access Gateway
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Okta Access Gatewayto a version that resolves this vulnerability.Fixed in 2026.9.1
Event History
Sep 8, 2026
CVE Published
via MITRE·08:05 PM
Data Sourced
via MITRE·08:05 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access and conditions are required for exploitation?
The CVSS vector indicates that exploitation is network-accessible, requires high privileges, and does not require user interaction. It also has high attack complexity.
2
What is the potential security impact if exploitation succeeds?
The listed CVSS impacts are high for confidentiality, integrity, and availability. Injected nginx directives could therefore affect all three security properties of the gateway.