# CVE-2026-78545: Okta Access Gateway code injection in application label

Source: https://junglewise.ai/threats/cve-2026-78545-okta-access-gateway-code-injection-in-application-label  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78545 · Severity: medium · CVSS 6.6 · Published 2026-09-08

The Okta Access Gateway, a network appliance that manages secure application access, fails to properly validate the application label field before using it in configuration files. An authenticated administrator can inject malicious nginx directives through the label field, allowing them to execute arbitrary code on the gateway and potentially compromise application traffic and customer data.

Technologies: [Okta Access Gateway](https://junglewise.ai/threats/technologies/access-gateway). Vendors: [Okta](https://junglewise.ai/threats/vendors/okta).

## Quick answers

**Is CVE-2026-78545 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78545 being exploited in the wild.

**How severe is CVE-2026-78545?** Medium severity, with a CVSS score of 6.6, published 8 September 2026.

**Which products and versions are affected?** Okta Access Gateway prior to 2026.9.1.

**Is there a fix for CVE-2026-78545?** A patch was published on 2026-09-08: Fixed in version 2026.9.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78545 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-78545?** Check whether you run Okta Access Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a code injection flaw (CWE-94) in the Okta Access Gateway appliance. The application label field is not sanitized before being interpolated into nginx server block directives in the generated configuration file. An authenticated administrator with access to application create or update functionality can inject arbitrary nginx directives through the label field, leading to code execution with the privileges of the nginx process. The attack requires high privilege (administrator role) and high complexity, but can result in full compromise of confidentiality, integrity, and availability. The vulnerability is resolved in version 2026.9.1 and later.

## Affected products

- Okta Access Gateway prior to 2026.9.1

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in version 2026.9.1

## References

- [https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545/](https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-application-label-configuration-cve-2026-78545/)

## Related threats

- [Okta Access Gateway command execution in Admin Console](https://junglewise.ai/threats/cve-2026-115547-an-input-validation-issue-in-the-okta-access-gateway-oag-admin)
- [Okta Access Gateway authentication source validation bypass](https://junglewise.ai/threats/cve-2026-115546-okta-access-gateway-oag-does-not-validate-the-selected)
- [Okta Access Gateway OS command injection in SNMP configuration](https://junglewise.ai/threats/cve-2026-78630-okta-access-gateway-os-command-injection-in-snmp-configuration)
- [Okta Access Gateway authorization bypass in Protected Rules](https://junglewise.ai/threats/cve-2026-78626-okta-access-gateway-authorization-bypass-in-protected-rules)
- [Okta Access Gateway code injection in dashboard labels](https://junglewise.ai/threats/cve-2026-78625-okta-access-gateway-code-injection-in-dashboard-labels)