Executive brief
The Okta Privileged Access client is a tool administrators use to securely manage access to infrastructure and servers. A vulnerability allows an attacker to inject arbitrary command-line options by crafting an SSH target with a leading hyphen in the username field, potentially enabling unauthorized command execution when a user attempts to connect to a compromised or malicious server configuration.
Technical details
The vulnerability is an improper input validation issue (CWE-78) in which the Okta Privileged Access client fails to reject leading hyphens in the username portion of SSH connection targets. When the client constructs an SSH command string and passes it to the underlying SSH process, a username starting with a hyphen (e.g., "-E /tmp/logfile") is interpreted as a command-line flag rather than a username, allowing arbitrary SSH options to be injected. The attack requires user interaction—a user must attempt to connect to or be directed toward a malicious SSH target configuration. Successful exploitation can lead to command execution with the privileges of the SSH session. The vulnerability affects versions 1.59.0 through 1.110.0 and is fixed in version 1.111.1 and later.
Affected products
- Okta Privileged Access client 1.59.0 through 1.110.0
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in version 1.111.1