CVE-2026-63378

Received Received - Intake

TAKO AI Agent for Okta Remote Code Execution via Bypassed Python Code Filtering

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `script_code` field of `POST /api/react/execute-script`, without administrator privilege. In `src/api/routers/react_stream.py`, the source is stored with `skip_discovery=True`, bypassing AI-based content filtering, and is passed to `validate_generated_code` in `src/utils/security_config.py`. `BLOCKED_PATTERNS` recognizes direct `__import__` calls but misses the import name passed as a string, `getattr` is in `ALLOWED_BUILTINS`, and the AST checker handles `ast.Name` and `ast.Attribute` targets but fails to handle `ast.Call` targets. Dynamic `getattr` call chains through `__builtins__` therefore evade validation. The `_write_temp_script` helper writes the accepted code to disk, and `asyncio.create_subprocess_exec()` executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through `GET /api/react/stream-react-updates?process_id=<id>`. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63378

Affected Vendors & Products

Vendor	Product	Version / Range
fctr-id	okta-ai-agent	< 3.0.1-beta

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

TAKO AI Agent for Okta allows authenticated users to submit arbitrary Python code via a specific API endpoint without admin privileges. The code bypasses security checks by using dynamic imports and getattr calls, which evade pattern matching. The code is executed as root, leading to full container compromise.

Detection Guidance

Check for unauthorized Python script execution attempts in logs, particularly POST requests to /api/react/execute-script with script_code parameters. Monitor for unexpected file writes in the application directory or root-owned files created by the application user. Inspect network traffic for outbound connections from the container to unexpected destinations.

Impact Analysis

An attacker could gain root access to the container, steal secrets like Okta API tokens or JWT keys, access the SQLite database, and pivot to other backend services. This could result in data breaches, unauthorized access, and persistent compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, non-compliance penalties, and loss of trust in handling regulated data.

Mitigation Strategies

Upgrade to TAKO AI Agent for Okta version 3.0.1-beta or later immediately. If upgrading is not possible, restrict access to the /api/react/execute-script endpoint to administrators only and disable the AI agent functionality until patched. Review container permissions to ensure the application does not run as root.

Hi! I’m here to help you understand CVE-2026-63378. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70