CVE-2026-78545Medium· 6.6▾ SunlitThe Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of in…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-78550Medium· 6.6The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session
CVE-2026-78625Medium· 6.7The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files
CVE-2025-14576High· 7.8Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick
CVE-2025-15394Medium· 4.7A vulnerability was detected in iCMS up to 8.0.0
CVE-2025-15393Medium· 6.3A security vulnerability has been detected in Kohana KodiCMS up to 13.82.135
CVE-2026-78635Medium· 5.0The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments