CVE-2026-78626High· 8.1▾ TwilightThe Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protect…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.4%
The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.
access_gateway < 2026.9.1Upgrade past the affected range:
access_gateway 2026.9.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-78630Medium· 6.7The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands
CVE-2026-78545Medium· 6.6The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file
CVE-2026-78550Medium· 6.6The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session
CVE-2026-78552Medium· 6.0The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field
CVE-2026-78560Medium· 4.8The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation
CVE-2026-78579Medium· 6.8The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration