CVE-2026-78623 Overview
CVE-2026-78623 is a SQL injection vulnerability in Okta Access Gateway. The product does not sanitize Security Assertion Markup Language (SAML) assertion values before interpolating them into database queries in the advanced mode datastore configuration. Unsanitized values substitute directly into the query string prior to statement preparation, allowing unintended SQL execution against the configured backend database. The flaw is classified as improper neutralization of special elements used in an SQL command [CWE-89]. An authenticated attacker who can influence SAML assertion attribute values can manipulate query logic, read unauthorized data, or alter records within the datastore.
Critical Impact
An attacker able to control SAML assertion attributes can inject arbitrary SQL into the Access Gateway's backend datastore query path, exposing or modifying data.
Affected Products
- Okta Access Gateway (advanced mode datastore configuration)
Discovery Timeline
- 2026-09-08 - CVE-2026-78623 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-78623
Vulnerability Analysis
Okta Access Gateway supports an advanced mode configuration for datastores that allows administrators to define custom queries. In this configuration, values received from SAML assertions are interpolated directly into the SQL query string. The interpolation occurs before the statement is prepared, bypassing the parameter binding that would otherwise separate user-controlled data from query logic. As a result, SAML attribute values become part of the SQL grammar rather than opaque parameters. An attacker who controls or influences the SAML assertion, for example through a compromised identity provider account or a manipulated federation flow, can inject SQL syntax that the backend database will execute. The vulnerability is network-reachable through the standard SAML single sign-on flow.
Root Cause
The root cause is string-based query construction in the advanced mode datastore feature. The Access Gateway substitutes SAML assertion attributes into the query template with no escaping, quoting, or type validation. Statement preparation happens after substitution, so parameter binding provides no protection. This is a classic instance of [CWE-89] where the boundary between code and data is not enforced.
Attack Vector
Exploitation requires an authenticated user with low privileges whose SAML assertion values reach a vulnerable datastore query. An attacker crafts a SAML assertion containing SQL metacharacters in an attribute that the advanced mode datastore query references. When Access Gateway processes the assertion and executes the datastore query, the injected SQL runs with the privileges of the configured database account. Impact depends on that account's permissions and can include data disclosure, modification, or lateral access to other schemas visible to the connection.
No verified public proof-of-concept is available. See the Okta Security Advisory CVE-2026-78623 for vendor technical details.
Detection Methods for CVE-2026-78623
Indicators of Compromise
- SAML assertion attributes containing SQL metacharacters such as single quotes, semicolons, -- comment sequences, or UNION SELECT fragments.
- Database audit logs showing unexpected query structures originating from the Access Gateway service account.
- Access Gateway logs referencing datastore query failures or syntax errors correlated with SSO events.
Detection Strategies
- Parse SAML assertion attribute values at the identity provider and Access Gateway boundary and flag entries containing SQL syntax tokens.
- Baseline the query shapes issued by Access Gateway to the backend datastore and alert on deviations from the expected templates.
- Correlate authentication events with database query anomalies within the same session window to identify injection attempts.
Monitoring Recommendations
- Enable verbose auditing on the backend database account used by Access Gateway and forward logs to a centralized analytics platform.
- Monitor Access Gateway advanced mode datastore configurations for changes that introduce unparameterized query patterns.
- Alert on repeated failed datastore queries following SSO events, which can indicate injection probing.
How to Mitigate CVE-2026-78623
Immediate Actions Required
- Review the Okta Security Advisory CVE-2026-78623 and apply the fixed Access Gateway release identified by Okta.
- Inventory all advanced mode datastore configurations and identify queries that reference SAML assertion attributes.
- Restrict the database account used by Access Gateway to the minimum privileges required for its queries.
Patch Information
Okta has published a security advisory for CVE-2026-78623. Refer to the Okta Security Advisory CVE-2026-78623 for fixed versions and upgrade instructions.
Workarounds
- Disable advanced mode datastore configurations that interpolate SAML assertion values into query strings until the patch is applied.
- Constrain SAML attribute values at the identity provider to a strict allowlist of characters and lengths.
- Rotate credentials used by the Access Gateway database account and audit recent datastore activity for unauthorized queries.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
