6.6mediumMedium
CVE-2026-78545
The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
- To exploit it, an administrative account is needed.
- Beyond that, no action by a user is required.
Scoring
- CVSS
- 6.6 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H- Weakness
- CWE-94
- Assigned by
- psirt@okta.com
Dates
- Published
- 2026-09-08
- Last modified
- 2026-09-10
- Sources
- NVD