CVE-2026-78545: Okta Access Gateway

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.

Affected products

• Okta Access Gateway: before 2026.9.1 (fixed in 2026.9.1)

Published 2026-09-08. Last modified 2026-09-29.