# CVE-2026-78545: Improper Input Sanitization in Okta Access Gateway Application Label Configuration

> CVE-2026-78545: Improper Input Sanitization in Okta Access Gateway Application Label Configuration. CVSS 6.6 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-78545
Last updated: 2026-09-29T20:19:22Z

- Published: 2026-09-08 20:05 UTC · Updated: 2026-09-29 20:19 UTC · Assigner: Okta
- CVSS: 6.6 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.38%, 32th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-94

## Description

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.

## Affected vendors and products

- Okta: Okta Access Gateway

## Tracked companies

- [Okta](https://rewindex.com/company/okta.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78545)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-78545)
- [https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545/](https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545/)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-78545 · Markdown: https://rewindex.com/cve/CVE-2026-78545.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-78545 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:07.285Z