Description

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.

Affected product and versions

Customers using the Okta Access Gateway appliance versions prior to 2026.9.1 are affected.

Preconditions

This applies if the following preconditions are present:

1. The Okta Access Gateway administrative management interface is network-reachable,

2. An authenticated user holds administrator privileges with authorization to upload and restore appliance backup files.

Customer Recommendations

To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater. 

Resolution

The vulnerability is present in the Okta Access Gateway appliance versions prior to 2026.9.1 and is resolved in version 2026.9.1.

CVE details

References

Download the Okta Access Gateway image