TAKO AI Agent CVE-2026-63378

Exploitation requires (1) a network-reachable instance of the okta-ai-agent application and (2) any authenticated account - a valid fctr_session cookie obtained through the normal registration or login flow; no administrator or elevated privilege is checked on POST /api/react/execute-script. No special non-default configuration is needed: the validator bypass works against the shipped code, and the maximal (root) impact occurs specifically in the default Docker deployment where the application process runs as root. Limiting factors that reduce real-world risk: the attacker must hold or obtain valid credentials (via registration where open, phishing, or credential stuffing), the endpoint must be reachable (the default image exposed 0.0.0.0:8001, which the fix commit changes to bind 127.0.0.1), and non-container or non-root deployments reduce the blast radius below full host/container compromise. The complete-fix path is upgrading to v3.0.1-beta, which disables client-supplied script execution and drops root privileges.

This is a genuine high-priority issue for anyone running the affected product, not an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only a low-privileged authenticated session - consistent with the advisory's statement that any user holding a valid fctr_session cookie (obtainable via normal registration/login) can trigger it with no admin privilege. The triple-impact C:H/I:H/A:H is justified because the sink is direct OS command execution as the process user, confirmed root in the default container. A complete, self-contained PoC is published in the GHSA advisory and the reporter documents a confirmed dynamic reproduction returning uid=0(root), so exploitability is proven rather than theoretical. Not in CISA KEV and no EPSS score was provided in the input, so there is no signal of mass in-the-wild exploitation yet; the vuln.today decision label is 'this_week' (not act_now/emergency). Net: a proven, low-complexity authenticated-to-root RCE with public working exploit code - remediate within the week per the decision label - tempered only by the authentication prerequisite and the product's limited, early-beta deployment footprint.

An attacker who has registered or obtained any valid low-privilege account logs in to get an fctr_session cookie, then sends a POST to /api/react/execute-script whose script_code uses a dynamic getattr(__builtins__, "__import__")("os") chain that evades the regex blocklist, the ALLOWED_BUILTINS list, and the AST checker. The server writes the code to disk and runs it via asyncio.create_subprocess_exec as root in the default container, and the attacker reads command output from the SSE stream. A full working PoC confirming uid=0(root) is published in the GHSA advisory.