CVE-2026-78545 — Improper Input Sanitization in Okta Access Gateway Application Label Configuration
The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into a…
Published: 2026-09-08 · CVSS: 6.6 · CVSS 3.1
The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7