Okta Access Gateway

The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local user with access to the management interface can supply crafted values, resulting in the execution of arbitrary OS commands with root privileges.

Published: 2026-09-08T20:14:52.442Z
Updated: 2026-09-10T14:40:54.476Z

The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic.

Published: 2026-09-08T20:12:53.558Z
Updated: 2026-09-10T14:37:56.057Z

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.

Published: 2026-09-08T20:10:15.711Z
Updated: 2026-09-10T14:31:46.246Z

The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.

Published: 2026-09-08T20:06:27.769Z
Updated: 2026-09-10T17:52:48.219Z

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.

Published: 2026-09-08T20:13:23.266Z
Updated: 2026-09-10T14:49:41.141Z