# CVE-2026-78620: Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling

> CVE-2026-78620: Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling. CVSS 5.9 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-78620
Last updated: 2026-09-22T20:39:20Z

- Published: 2026-09-08 20:13 UTC · Updated: 2026-09-22 20:39 UTC · Assigner: Okta
- CVSS: 5.9 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
- EPSS: 0.34%, 27th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-73

## Description

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.

## Affected vendors and products

- Okta: Okta Access Gateway

## Tracked companies

- [Okta](https://rewindex.com/company/okta.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78620)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-78620)
- [https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-kerberos-configuration-handling-cve-2026-78620](https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-kerberos-configuration-handling-cve-2026-78620)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-78620 · Markdown: https://rewindex.com/cve/CVE-2026-78620.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-78620 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:22.876Z