CVE-2026-78552

Analyzed Analyzed - Analysis Complete

Lua Directive Injection in Okta Access Gateway

Publication date: 2026-09-08

Last updated on: 2026-09-23

Assigner: Okta

Description

The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-23

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-78552

Affected Vendors & Products

Vendor	Product	Version / Range
okta	access_gateway	to 2026.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

The Okta Access Gateway has a flaw where it does not properly restrict Lua directives in a specific configuration field. This field is directly inserted into the nginx server block without validation, allowing attackers to inject malicious Lua code that gets executed.

Impact Analysis

An attacker could exploit this to execute arbitrary commands on the server, potentially gaining unauthorized access, stealing data, or disrupting services. The impact depends on the server's permissions and network configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, fines, or reputational damage if exploited.

Mitigation Strategies

Apply the latest Okta Access Gateway update to patch the Lua directive restriction bypass. Review custom configuration fields for unauthorized directives and remove any suspicious entries. Monitor nginx server blocks for unexpected Lua code execution.

Hi! I’m here to help you understand CVE-2026-78552. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70