CVE-2026-78552

The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives.

Score

CVSS 3.1 6.0 Medium

Status

Analyzed - psirt@okta.com

Published

2026-09-08

Last modified

2026-09-10

Weaknesses

CWE-693

Affected products

• Access Gateway (Okta)
• Okta Access Gateway (Okta)

References

• https://trust.okta.com/security-advisories/validation-bypass-in-okta-access-gateway-custom-directives-cve-2026-78552