CVE-2026-78552: Validation Bypass in Okta Access Gateway Custom Directives
The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Okta Access Gateway applianceto a version that resolves this vulnerability.Fixed in 2026.9.1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs high privileges. Exploitation requires access sufficient to modify the application-level custom configuration field.
What configuration path is affected?
The affected path is the application-level custom configuration field. Its contents are interpolated directly into the nginx server block without the Lua directive restriction being applied.
What is the potential impact of successful exploitation?
Injected nginx directives can be executed. The reported impact includes low confidentiality impact, high integrity impact, and low availability impact.