SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-78545

MEDIUM · CVSS 6.6 EPSS 0.36%

Source: NVD + CISA KEV + EPSS · Published 2026-09-08 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The vulnerability affects the Okta Access Gateway, which fails to properly sanitize the application label field before incorporating it into the Nginx configuration file. This oversight allows for the injection of malicious directives into the Nginx server block, potentially leading to unauthorized command execution. Organizations utilizing Okta Access Gateway with Nginx should prioritize addressing this issue to mitigate the risk of exploitation.

CVE
CVE-2026-78545
Severity
MEDIUM
CVSS
6.6
EPSS
0.36%
Nginx

Original NVD Description

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.