EUVD-2026-74178
GHSA-q832-9j8g-vg4h
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Admin credentials required to submit Kerberos config payloads (PR:H); specific event-handling context required (AC:H); arbitrary write yields I:H and traversal-based reads yield C:H.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
3DescriptionCVE.org
The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.
AnalysisAI
Arbitrary file write in Okta Access Gateway (all versions before 2026.9.1) allows a highly privileged authenticated attacker to direct the Kerberos configuration handler to write files to arbitrary locations on the appliance filesystem by supplying a path traversal string in an event payload. The root cause is CWE-73 (External Control of File Name or Path): the handler uses the payload-supplied path directly as the write destination without sanitization or canonicalization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated access at the admin privilege level (PR:H per CVSS) on the Okta Access Gateway appliance - this is not a remote unauthenticated attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N, score 5.9) reflects a meaningful real-world constraint: exploitation is gated on high-privilege admin access and elevated attack complexity, sharply limiting the exploitable population to insiders, compromised admin accounts, or authenticated post-exploitation chains. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Okta Access Gateway to version 2026.9.1 or later, which introduces proper path validation in the Kerberos configuration handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today