CVE-2026-78545
Last modified
CVE-2026-78545 is a medium-severity vulnerability rated 6.6/10 on the CVSS scale. The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.. EPSS estimates a 0.36% chance of exploitation in the next 30 days.
Description
The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Okta | Okta Access Gateway | < 2026.9.1 |
References
Timeline
- Published
- Last Modified
- Status
- Undergoing Analysis
Frequently Asked Questions
What is CVE-2026-78545?
How severe is CVE-2026-78545?
How do I fix CVE-2026-78545?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-78528Unauthenticated Broken Access Control in BerqWP <= 4.1.15 ve…5.3
- CVE-2026-7853A weakness has been identified in D-Link DI-8100 16.07.26A1.…9.8
- CVE-2026-78536Unauthenticated Broken Access Control in Robokassa payment g…6.5
- CVE-2026-7854A security vulnerability has been detected in D-Link DI-8100…9.8
- CVE-2026-78541A stored OS command injection vulnerability exists in the pa…8.5
- CVE-2026-78543IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12…7.5
- CVE-2026-78546Out-of-bounds read vulnerability in Citirx Workspace app for…4.8
- CVE-2026-78547Out-of-bounds write vulnerability in Citrix Citrix Workspace…4.4
- CVE-2026-7855A vulnerability was detected in D-Link DI-8100 16.07.26A1. A…7.2
- CVE-2026-78550The Okta Access Gateway management console passes user-suppl…6.6
- CVE-2026-78551RansomLook contains multiple weaknesses in its authenticatio…8.8
- CVE-2026-78552The Okta Access Gateway does not apply its Lua directive res…4.9
Are you affected by CVE-2026-78545?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST