CVE-2026-78579— Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation
Quick assessment
Affected
Okta Okta Access Gateway
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Okta 访问网关（Okta Access Gateway）在将 SAML 断言属性值插入到 LDAP 数据源配置中的 LDAP 搜索过滤器之前，未对其进行过滤或清理。这些原始值会被直接替换到过滤器字符串中，并传递给 LDAP 搜索操作执行，从而导致原本预期的查询逻辑被篡改。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78579
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation
Source: CVE Program / CVE List V5
Vulnerability Description
The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Okta | Okta Access Gateway | 0 ~ 2026.9.1 | - |
|
II. Public POCs for CVE-2026-78579
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78579
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-78579 (1)
Same Patch Batch · Okta · 2026-09-08 · 17 CVEs total
| CVE-2026-78626 | 8.1 HIGH | Improper Input Sanitization in Okta Access Gateway Protected Rules |
| CVE-2026-78623 | 7.7 HIGH | Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datast |
| CVE-2026-78574 | 7.5 HIGH | Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling |
| CVE-2026-78627 | 7.3 HIGH | Improper Credential Protection in Okta Hyperdrive Integration Installer Logging |
| CVE-2026-78625 | 6.7 MEDIUM | Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard S |
| CVE-2026-78630 | 6.7 MEDIUM | Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing |
| CVE-2026-78550 | 6.6 MEDIUM | Improper Input Handling in Okta Access Gateway Management Console Exception Handler |
| CVE-2026-78545 | 6.6 MEDIUM | Improper Input Sanitization in Okta Access Gateway Application Label Configuration |
| CVE-2026-78552 | 6.0 MEDIUM | Validation Bypass in Okta Access Gateway Custom Directives |
| CVE-2026-78622 | 6.0 MEDIUM | Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal |
| CVE-2026-78620 | 5.9 MEDIUM | Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling |
| CVE-2026-78629 | 5.6 MEDIUM | Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling |
| CVE-2026-78631 | 5.3 MEDIUM | Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging |
| CVE-2026-78635 | 5.0 MEDIUM | Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument |
| CVE-2026-78624 | 4.9 MEDIUM | Improper Path Validation in Okta Access Gateway Backup and Restore Functionality |
| CVE-2026-78560 | 4.8 MEDIUM | Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Sour |
IV. Related Vulnerabilities
Same product: Okta Access Gateway
-
CVE-2026-78630
Improper Input Neutralization in Okta Access Gateway SNMP Co -
CVE-2026-78620
Improper Path Validation in Okta Access Gateway Kerberos Con -
CVE-2026-78626
Improper Input Sanitization in Okta Access Gateway Protected -
CVE-2026-78625
Insufficient Validation of Dashboard Application Labels in O -
CVE-2026-78624
Improper Path Validation in Okta Access Gateway Backup and R
Same vendor: Okta
-
CVE-2026-78622
Improper Link Resolution in Okta Verify for Windows Uninstal -
CVE-2026-78631
Improper Restriction of Sensitive Information in Okta Hyperd -
CVE-2026-78630
Improper Input Neutralization in Okta Access Gateway SNMP Co -
CVE-2026-78629
Improper Authentication Verification in the Okta Hyperdrive -
CVE-2026-78635
Improper Input Validation in the Okta Privileged Access SSH
Same weakness: CWE-90
-
CVE-2026-81205
LDAP / Active Directory Integration - Moderately critical - -
CVE-2026-75020
Apache APISIX: ldap-auth plugin cross-subtree identity imper -
CVE-2026-19271
Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's -
CVE-2026-76373
Filter Injection through Action Parameters in AD LDAP app fo -
CVE-2026-19930
Dolibarr User Cloning card.php ldap injection
V. Comments for CVE-2026-78579
No comments yet