Description

The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives.

Affected product and versions

Customers using Okta Access Gateway appliance versions prior to 2026.9.1 are affected.

Preconditions

This applies if the following preconditions are present:

1. An authenticated user holds administrator privileges with the ability to create or modify application configurations via console,

2. Application configuration is applied and reloaded on the appliance.

Customer Recommendations

To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.

Resolution

The vulnerability is present in Okta Access Gateway appliance versions prior to 2026.9.1 and is resolved in version 2026.9.1.

CVE details

References

Download the Okta Access Gateway image