CVE-2026-78620: Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling
The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Okta Access Gateway applianceto a version that resolves this vulnerability.Fixed in 2026.9.1
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
An attacker needs high privileges and network access to the affected Okta Access Gateway. User interaction is not required, but exploitation has high attack complexity.
What could an attacker do if exploitation succeeds?
The attacker can cause file contents to be written to unintended locations on the appliance filesystem using paths supplied in event payloads. The provided severity vector indicates high confidentiality and integrity impact, with no availability impact.
How can I determine whether my deployment may be affected?
Review whether your Okta Access Gateway processes Kerberos configuration event payloads and whether a high-privileged network-accessible actor could control file-path values in those payloads. The available information does not identify affected versions or a detection method.