---
id: CVE-2026-78623
title: >-
  The Okta Access Gateway does not sanitize SAML assertion values before
  interpolating them into database queries in the advanced mode datastore
  configuration
summary: >-
  The Okta Access Gateway does not sanitize SAML assertion values before
  interpolating them into database queries in the advanced mode datastore
  configuration. The unsanitized values are substituted directly into the query
  string prior to …
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L'
cwe:
  - CWE-89
vendor: okta
product: access_gateway
affected:
  - access_gateway < 2026.9.1
patched:
  - access_gateway 2026.9.1
published: '2026-09-08'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:27:41.180'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78623'
references:
  - url: >-
      https://trust.okta.com/security-advisories/improper-handling-of-saml-assertion-attributes-in-okta-access-gateway-advanced-mode-datastores-cve-2026-78623
    label: psirt@okta.com
tags:
  - nvd
  - cve.org
epss: 0.0045
epssPercentile: 0.36453
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T17:52:02.307541Z'
ingestedAt: '2026-09-08T21:11:12.319Z'
---

## Overview

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.

## Affected

- `access_gateway < 2026.9.1`

## Remediation

Upgrade past the affected range:

- `access_gateway 2026.9.1`