CVE-2026-78624: Improper Limitation of a Pathname to a Restricted Directory in Okta Okta Access Gateway

The Okta Access Gateway backup restore function improperly limits pathname validation by not verifying the filename embedded in an encrypted backup payload. This can lead to files being written outside intended restricted directories on the appliance filesystem, potentially allowing unauthorized file placement. The vulnerability affects versions >=0 and <2026.9.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

An attacker with high privileges on the network could exploit this vulnerability to write files to arbitrary locations on the Okta Access Gateway appliance filesystem. This could lead to unauthorized disclosure of sensitive information stored in those files. There is no indication of integrity or availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the backup restore function to trusted administrators only and monitor for unauthorized file modifications on the appliance filesystem.