---
id: CVE-2026-78545
title: >-
  The Okta Access Gateway does not sanitize the application label field before
  including it in the generated nginx configuration file
summary: >-
  The Okta Access Gateway does not sanitize the application label field before
  including it in the generated nginx configuration file. The unsanitized value
  is interpolated into an nginx server block directive, resulting in execution
  of in…
severity: medium
cvss: 6.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: okta
product: access_gateway
affected:
  - access_gateway < 2026.9.1
patched:
  - access_gateway 2026.9.1
published: '2026-09-08'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T20:19:22.983'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78545'
references:
  - url: >-
      https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545/
    label: psirt@okta.com
tags:
  - nvd
  - cve.org
epss: 0.00382
epssPercentile: 0.32003
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T18:00:45.406892Z'
ingestedAt: '2026-09-08T21:11:12.319Z'
---

## Overview

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.

## Affected

- `access_gateway < 2026.9.1`

## Remediation

Upgrade past the affected range:

- `access_gateway 2026.9.1`