Medium severity · published Sep 8, 2026
CVE-2026-78579
Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
Okta Access Gateway · Okta
before 2026.9.1 · source: vendor
AG
Access Gateway · Okta
before 2026.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78579
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78579
Vendor Advisory
https://trust.okta.com/security-advisories/improper-input-sanitization-in-okta-access-gateway-ldap-datastore-filter-interpolation-cve-2026-78579
More from Okta Access Gateway
9.9
CVE-2026-78623
Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores
9.1
CVE-2026-115547
Command Execution via Admin Console Input in Okta Access Gateway
8.1
CVE-2026-115546
Authentication Source Verification Issue in Okta Access Gateway
7.2
CVE-2026-78550
Improper Input Handling in Okta Access Gateway Management Console Exception Handler
7.2
CVE-2026-78545
Improper Input Sanitization in Okta Access Gateway Application Label Configuration