CVE-2026-77585: Okta Privileged Access RCE Vulnerability

CVE-2026-77585 Overview

CVE-2026-77585 affects the Okta Privileged Access (OPA) client. The client fails to reject a leading hyphen in the username portion of an SSH target. When the value reaches the underlying SSH process, it can be interpreted as a command-line option rather than a username. This behavior maps to [CWE-78] OS command injection through improper neutralization of special elements. Successful exploitation requires user interaction and local access, and it can lead to disclosure of sensitive information handled by the SSH client process.

Critical Impact
An attacker who convinces a user to connect to a crafted SSH target through the Okta Privileged Access client can inject SSH command-line options, enabling abuse of the SSH process to disclose local information.

Affected Products

Okta Privileged Access client (SSH connection handling)

Discovery Timeline

2026-08-25 - CVE-2026-77585 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77585

Vulnerability Analysis

The Okta Privileged Access client brokers SSH sessions to target hosts on behalf of authenticated users. When constructing the SSH invocation, the client does not validate that the username field begins with an allowed character set. A username that starts with - is passed directly to the underlying SSH binary. The SSH process then parses the token as an option flag such as -o or -oProxyCommand=, altering session behavior in ways the user did not authorize.

This is an argument injection pattern classified under [CWE-78]. It shifts control of SSH client configuration from the OPA broker to the attacker-supplied target string.

Root Cause

The root cause is missing input validation on the username portion of an SSH target. The client accepts arbitrary leading characters and forwards them without escaping or an -- argument terminator. Because standard SSH clients treat leading-hyphen tokens as options, any username beginning with - becomes a directive to the SSH process instead of an identity.

Attack Vector

Exploitation requires local execution of the OPA client and user interaction. An attacker crafts an SSH target where the username field begins with a hyphen and delivers it to a victim through a link, script, or configuration entry. When the user initiates the connection, the OPA client invokes SSH with the malicious token. The SSH process interprets the token as an option, which can be used to load attacker-controlled configuration, redirect connection parameters, or expose local files to the SSH process context. Confidentiality impact is rated high while integrity impact is limited and availability is unaffected.

No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-77585

Indicators of Compromise

SSH invocations originating from the Okta Privileged Access client where the username argument begins with -.
OPA client log entries or session records showing target strings such as -oProxyCommand=, -oIdentityFile=, or similar option-like usernames.
Unexpected outbound connections or file reads by the SSH child process spawned from the OPA client.

Detection Strategies

Inspect process command lines for ssh children of the OPA client where argv contains a token starting with - in the user@host position.
Correlate OPA session initiation events with SSH client configuration reads from non-standard paths.
Alert on SSH sessions where the effective options differ from the OPA-managed policy baseline.

Monitoring Recommendations

Enable command-line auditing on endpoints running the OPA client, on Windows through Sysmon Event ID 1 and on Linux through auditdexecve records.
Forward OPA client logs and endpoint process telemetry to a central analytics platform for retrospective hunting against the argument-injection pattern.
Review privileged session recordings for anomalous SSH option strings appearing in target metadata.

How to Mitigate CVE-2026-77585

Immediate Actions Required

Update the Okta Privileged Access client to the fixed version identified in the Okta Security Advisory CVE-2026-77585.
Audit stored SSH targets, bookmarks, and provisioning workflows for usernames that begin with - and remove or correct them.
Instruct users to avoid clicking SSH connection links received from untrusted sources.

Patch Information

Okta has published guidance and fixed builds in its security advisory. Refer to the Okta Security Advisory CVE-2026-77585 for supported versions and upgrade instructions.

Workarounds

Enforce username validation at the identity provider or provisioning layer, rejecting any SSH target whose username does not match a strict allowlist such as ^[A-Za-z0-9_][A-Za-z0-9_.-]*$.
Restrict use of the OPA client to trusted target inventories and disable ad-hoc target entry where feasible.
Apply endpoint application control to constrain which arguments and configuration files the SSH client on managed hosts is permitted to load.

bash

# Example validation for SSH usernames before passing to the client
username="$1"
if ! printf '%s' "$username" | grep -Eq '^[A-Za-z0-9_][A-Za-z0-9_.-]*$'; then
  echo "Rejected: username contains disallowed leading character" >&2
  exit 1
fi
ssh -- "${username}@${host}"