CVE-2026-78620 — Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling
The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is …
Published: 2026-09-08 · CVSS: 5.9 · CVSS 3.1
The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7