CVE-2026-78545 — Improper Input Sanitization in Okta Access Gateway Application Label Configuration

CVE-2026-78545

Improper Input Sanitization in Okta Access Gateway Application Label Configuration PUBLISHED

Description (CNA)

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.

Affected (CNA)

Vendor / product	Versions
Okta / Okta Access Gateway	affected 0 before 2026.9.1

CWE

CWE-94

References

https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.