The Okta Access Gateway fails to enforce its Lua directive restriction on the application-level custom configuration field. This field is interpolated directly into the nginx server block without validation or inspection, resulting in the potential execution of injected nginx directives. This protection mechanism failure could allow an attacker with high privileges to inject malicious configuration directives, impacting the integrity and confidentiality of the system. The vulnerability has a CVSS 3.1 base score of 6.0, indicating medium severity. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with high privileges could exploit this vulnerability to inject and execute arbitrary nginx directives within the Okta Access Gateway configuration. This may lead to partial loss of confidentiality, high integrity compromise, and low availability impact of the affected system. The vulnerability does not require user interaction but does require privileged access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the application-level custom configuration field to trusted administrators only and monitor configuration changes closely.