CVE-2026-78579: Okta Access Gateway LDAP Injection Flaw

CVE-2026-78579 Overview

CVE-2026-78579 is an LDAP injection vulnerability in the Okta Access Gateway. The product does not sanitize Security Assertion Markup Language (SAML) assertion attribute values before interpolating them into Lightweight Directory Access Protocol (LDAP) search filters within the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation. An authenticated attacker who can influence SAML assertion attributes can modify the intended query logic. The weakness is categorized as [CWE-90] Improper Neutralization of Special Elements used in an LDAP Query.

Critical Impact
An attacker with low privileges can manipulate LDAP search filters to access unauthorized directory data or alter authentication and authorization decisions.

Affected Products

Okta Access Gateway (LDAP datastore configuration)
Deployments consuming SAML assertion attributes for LDAP lookups
Environments using LDAP as a downstream identity source through Okta Access Gateway

Discovery Timeline

2026-09-08 - CVE-2026-78579 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78579

Vulnerability Analysis

The Okta Access Gateway acts as a reverse proxy that federates authentication using SAML and enriches sessions with attributes drawn from backend directories through LDAP. In the affected configuration, SAML assertion attribute values are inserted verbatim into an LDAP search filter template. Because special LDAP metacharacters such as *, (, ), \, and NUL are not escaped, an attacker who controls or influences the SAML attribute values can inject filter syntax. The injected content changes how the resulting search filter is evaluated by the LDAP server, expanding or narrowing the result set beyond what the application intended. Exploitation requires network access to the gateway and a low-privileged authenticated context capable of shaping the SAML assertion, with high attack complexity reflecting the conditions needed to weaponize the flaw.

Root Cause

The root cause is missing input neutralization before string interpolation into an LDAP query. The gateway concatenates untrusted SAML attribute data with a fixed filter template rather than binding parameters or escaping reserved LDAP characters as defined in RFC 4515. This design pattern places responsibility for filter integrity on upstream identity providers, which cannot guarantee the shape of attribute values that flow through federated trust chains.

Attack Vector

An attacker delivers a crafted SAML assertion whose attribute values contain LDAP filter metacharacters. When the Access Gateway performs a directory lookup, the injected characters change the filter semantics. Depending on the surrounding filter, this can broaden matches to return sensitive attributes for unintended user records, or narrow matches to disrupt legitimate lookups. The vulnerability supports impacts to confidentiality and integrity of directory data used for access decisions, though it does not directly affect availability.

Refer to the Okta Security Advisory CVE-2026-78579 for vendor-specific technical detail.

Detection Methods for CVE-2026-78579

Indicators of Compromise

SAML assertion attribute values containing unescaped LDAP metacharacters such as *, (, ), or \.
Unexpected LDAP search filters logged by the directory server that deviate from the gateway's known filter templates.
Directory queries returning result sets significantly larger or narrower than baseline for the same user session.
Access Gateway sessions where post-authentication attribute lookups map to directory entries other than the authenticated subject.

Detection Strategies

Compare rendered LDAP filters against a known-good template set and alert on structural deviations.
Correlate SAML assertion contents with subsequent LDAP search operations to identify attribute-driven filter mutation.
Instrument the LDAP server to log full search filters, source IP, and bind identity for offline analysis.

Monitoring Recommendations

Forward Okta Access Gateway and LDAP server logs into a centralized analytics platform for pattern analysis.
Baseline the volume and shape of LDAP queries generated per authenticated session and alert on outliers.
Monitor for repeated failed or oversized directory responses that follow federated login events.

How to Mitigate CVE-2026-78579

Immediate Actions Required

Review the Okta Security Advisory CVE-2026-78579 and apply vendor-provided updates for the Access Gateway.
Audit LDAP datastore configurations for filter templates that interpolate SAML attribute values.
Restrict which SAML identity providers are trusted and validate the schema of accepted assertion attributes.

Patch Information

Okta has published guidance and remediation details in the vendor advisory. Administrators should upgrade Okta Access Gateway to the fixed release identified in the Okta Security Advisory CVE-2026-78579 and validate that LDAP datastore filter templates are handled by the patched code path.

Workarounds

Constrain SAML attribute values at the identity provider to an allowlist of characters that excludes LDAP metacharacters.
Where possible, replace interpolated attribute values with server-side lookups keyed by a validated identifier such as NameID.
Apply strict input validation on the gateway side for any attribute consumed by LDAP search filters, rejecting values containing *, (, ), \, or NUL bytes.

bash

# Configuration example
# Illustrative allowlist validation before LDAP filter interpolation
# Reject SAML attribute values that contain LDAP filter metacharacters
validate_attr() {
  case "$1" in
    *\**|*\(*|*\)*|*\\*) return 1 ;;
    *) return 0 ;;
  esac
}