CVE-2026-78620 — Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling

CVE-2026-78620

Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling PUBLISHED

Description (CNA)

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.

Affected (CNA)

Vendor / product	Versions
Okta / Okta Access Gateway	affected 0 before 2026.9.1

CWE

CWE-73

References

https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-kerberos-configuration-handling-cve-2026-78620

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.