CVE-2026-78635

Awaiting Analysis Awaiting Analysis - Queue

Okta Privileged Access Client Command-Line Injection via URL Handler

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: Okta

Description

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-78635

Affected Vendors & Products

Vendor	Product	Version / Range
okta	privileged_access_client	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

The Okta Privileged Access client URL handler has an improper input validation flaw. When a scaleft:// protocol link contains a value starting with a hyphen, the handler fails to add an option terminator before appending the target value to command-line arguments. This causes the SSH client to interpret the value as a command-line flag, altering its behavior.

Detection Guidance

Check Okta Privileged Access client versions between 1.18.0 and 1.112.0 using commands like 'scaleft version' or 'dpkg -l | grep scaleft' on Linux or 'Get-AppxPackage' on Windows. Inspect scaleft:// protocol handler links in browser history or logs for values starting with hyphens.

Impact Analysis

An attacker could craft a malicious scaleft:// link with a hyphen-prefixed value to manipulate the SSH client's behavior. This could lead to unintended actions, such as unauthorized access or data leakage, depending on the modified client behavior.

Mitigation Strategies

Upgrade Okta Privileged Access client to version 1.113.0 or later immediately. Disable or restrict scaleft:// protocol handler links in browsers until patched. Monitor network traffic for suspicious SSH client command modifications.

Hi! I’m here to help you understand CVE-2026-78635. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70