← Back

CVE-2026-78620

nvd nist
Published: Sep 8, 2026Modified: Sep 22, 2026

JSON object

Loading...
4.9
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Exploitability: 1.2 / Impact: 3.6
Source: NVD

Description

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.

Affected (1)

Products: Okta: Access Gateway
Okta
1 product
Access Gateway
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Access Gateway
version < 2026.9.1

Related CWEs

CWE-73
External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (1)

Source: psirt@okta.com
Vendor Advisory

Timeline

No history available yet.