The Okta Access Gateway management console improperly neutralizes directives in dynamically evaluated code by passing user-supplied input directly to eval() without sanitization during an authenticated administrator SSH session. This flaw enables an attacker with administrator SSH access to execute arbitrary code with the management console's privileges. The vulnerability is identified as CVE-2026-78550 and has a CVSS 3.1 base score of 6.6 (medium severity). There is no vendor advisory or patch information available at this time, and the affected versions are not explicitly stated.

Successful exploitation allows code execution with the privileges of the Okta Access Gateway management console during an authenticated administrator SSH session. This can lead to full compromise of the management console and potentially the underlying system. The impact includes confidentiality, integrity, and availability loss as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator SSH access to trusted personnel only and monitor for suspicious activity. No official fix or workaround has been published by Okta at this time.