CVE-2026-78623 is a high severity (CVSS 7.7) SQL injection in Okta Access Gateway before 2026.9.1. SAML assertion values are placed into database queries in advanced mode datastore configurations without sanitizing. Upgrade the appliance to 2026.9.1 or later, and review any custom datastore queries.
What's affected
- Product: Okta Access Gateway appliance.
- Affected: versions before 2026.9.1.
- Fixed: 2026.9.1.
- Weakness: CWE-89, SQL injection.
- CVSS 7.7 (high), vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L. Not listed in CISA KEV.
Okta lists preconditions. The gateway must use an advanced mode database datastore with custom SQL queries that reference SAML assertion attributes, and an active authentication session must supply attacker controlled values for at least one of those attributes.
How to check if you're exposed
Check the appliance version in the Okta Access Gateway admin console and compare it with 2026.9.1.
Then check the datastore configuration. Look for advanced mode database datastores whose custom SQL queries reference SAML assertion attributes. If you have none, the stated preconditions are not met, but upgrading is still the right step. If you have some, list which attributes feed the queries and who can influence their values.
What to do now
- Upgrade the Okta Access Gateway appliance to 2026.9.1 or later.
- Review advanced mode datastore queries that use SAML attributes.
- Make sure the database account the gateway uses has only the rights it needs.
- Look in database logs for unusual queries from the gateway account.
Why it matters
Okta says values from the SAML assertion were substituted straight into the query string before the query was prepared. That defeats the point of preparation, which is to keep data separate from the SQL text. The data was trusted because it came from an identity provider, but the user can often influence some attributes.
Treat identity attributes as untrusted input. A signed assertion proves who signed it, and says nothing about whether the values are safe to put into SQL.
Quick check
Does every gateway have the preconditions?
No. The advisory requires advanced mode datastores with custom queries that use SAML attributes, plus attacker controlled values.
Sources
Last reviewed: 19 October 2026.
