CVE-2026-78552: Protection Mechanism Failure in Okta Okta Access Gateway

The Okta Access Gateway fails to enforce Lua directive restrictions on the application-level custom configuration field. This field is directly interpolated into the nginx server block configuration without validation or sanitization, which can lead to execution of maliciously injected nginx directives. This vulnerability affects versions >=0 and <2026.9.1 of Okta Access Gateway. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and low availability impact.

An attacker with high privileges can inject directives into the nginx server block via the custom configuration field, potentially leading to unauthorized command execution or configuration manipulation. The confidentiality impact is low, but integrity impact is high, and availability impact is low. This could allow attackers to alter the behavior of the gateway or execute unauthorized actions within the nginx context.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to high-privilege users who can modify the application-level custom configuration field to prevent exploitation.