CVE-2026-78545 is a medium severity (CVSS 6.6) code injection flaw in the Okta Access Gateway appliance. The application label field is written into the generated nginx configuration without sanitizing, so injected directives can run. Okta says appliance versions before 2026.9.1 are affected and 2026.9.1 or later resolves it.
What's affected
- Okta Access Gateway appliance versions before 2026.9.1 are affected, according to Okta.
- Fixed in appliance version 2026.9.1. Okta recommends upgrading to 2026.9.1 or greater.
- Preconditions listed by Okta: the attacker is an authenticated administrator, and that administrator can use the application create or update functionality. This is why the score stays in the medium band.
Record severity: CVSS 6.6 (medium), vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-94, Improper Control of Generation of Code.
How to check if you're exposed
Open the Access Gateway admin console and note the appliance version shown there. If it is older than 2026.9.1, you are in the affected range. Then review who holds administrator rights on the gateway and who can create or edit applications. Okta published no workaround in the advisory text we fetched, so the upgrade is the remedy.
What to do now
- Confirm the current appliance version in the Access Gateway console.
- Download the 2026.9.1 or later image from the link in the Okta advisory and plan the upgrade window.
- Until you upgrade, limit the number of administrators who can create or update applications.
- Review recent application label changes for unusual characters, and check the generated configuration if your process allows it.
- Record the upgrade in your change log and close the ticket.
Why it matters
The flaw is a classic code injection (CWE-94). Text typed into a label field is treated as part of a configuration file that the web server later reads. When input is placed into a file that has its own syntax, a value can end the field it was meant for and add new instructions. The fix is to validate or escape every value before it is written into generated configuration.
The real risk depends on who holds admin rights. The advisory scores it at attack complexity high and privileges required high. A well run tenant with few administrators faces less exposure, but gateways sit in front of internal apps, so an administrator account takeover turns a medium issue into a more serious one. The record does not mark this CVE as exploited in the wild.
Quick check
Do I need to be an administrator to abuse this?
Yes. Okta lists an authenticated user with administrator privileges and access to application create or update as preconditions.
Is there a workaround?
The advisory we fetched gives only one remedy, upgrading to 2026.9.1 or later.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
