CVE-2026-78620
Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling
- State
- Published
- Severity
- 5.9 Medium
- Published
- Sep 8, 2026
- Updated
- Sep 10, 2026
- Reserved
- Aug 24, 2026
Description
The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N | Okta |
Weaknesses
- CWE-73 External Control of File Name or Path
Affected Products
| Product | Versions |
|---|---|
Okta Access GatewayOkta |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.