Kerberos Configuration Path Traversal in Okta Access Gateway

Publication date: 2026-09-08

Last updated on: 2026-09-22

Assigner: Okta

Description

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-22

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-78620

Affected Vendors & Products

Vendor	Product	Version / Range
okta	access_gateway	to 2026.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

The Okta Access Gateway Kerberos configuration handler has a flaw where it does not check file paths in event payloads before writing files. This allows attackers to specify arbitrary file paths, causing the system to write files to unintended locations on the appliance's filesystem.

Impact Analysis

This vulnerability could allow attackers to overwrite critical system files, install malicious software, or gain unauthorized access to sensitive data by writing files to unintended locations on the appliance.

Mitigation Strategies

Apply the latest security patches or updates provided by Okta for the Access Gateway to fix the Kerberos configuration handler file path validation issue.

Hi! I’m here to help you understand CVE-2026-78620. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70