Executive brief
Okta Access Gateway is an authentication appliance that integrates with enterprise identity systems. A SQL injection vulnerability allows authenticated attackers with control over SAML assertion attributes to execute arbitrary SQL queries against the backend database when advanced-mode datastore configuration is used, potentially exposing or modifying sensitive data.
Technical details
The vulnerability is a SQL injection (CWE-89) in the advanced-mode datastore configuration of Okta Access Gateway. SAML assertion attribute values are interpolated directly into SQL query strings without sanitization or parameterization, then executed against the configured backend database. Exploitation requires: (1) Okta Access Gateway configured with advanced-mode database datastore using custom SQL queries referencing SAML assertion attributes, and (2) an active authentication session where the attacker can control values of referenced SAML assertion attributes. An authenticated attacker can inject SQL commands to read, modify, or delete data in the backend database. The vulnerability is resolved in version 2026.9.1 and later.
Affected products
- Okta Access Gateway before 2026.9.1
Timeline
- 2026-09-08: disclosed