CVE-2026-78635: Okta Privileged Access Escalation Flaw

CVE-2026-78635 Overview

CVE-2026-78635 is an argument injection vulnerability in the Okta Privileged Access (OPA) client URL handler. The client processes scaleft:// protocol handler links without inserting an option terminator (--) before appending the target value to the SSH command line. When the target value begins with a hyphen, the underlying command-line interface (CLI) framework interprets it as a flag rather than a positional argument. This behavior enables attackers to inject SSH client options through crafted URLs, altering how the SSH client connects or executes. The flaw is tracked under CWE-88: Improper Neutralization of Argument Delimiters in a Command.

Critical Impact
A crafted scaleft:// link can modify SSH client behavior when a user activates it, leading to limited confidentiality, integrity, and availability impact on the endpoint.

Affected Products

Okta Privileged Access client (SSH URL handler component)
Endpoints where the scaleft:// protocol handler is registered
Systems relying on OPA for SSH session brokering

Discovery Timeline

2026-09-08 - CVE-2026-78635 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78635

Vulnerability Analysis

The Okta Privileged Access client registers a scaleft:// custom URL scheme. When a user clicks a scaleft:// link, the OPA client parses the URL and constructs an SSH command line that includes the target host or resource value. The client passes this value directly to the SSH invocation without prefixing an option terminator. Modern CLI parsers treat any argument beginning with - as an option or flag. An attacker who controls the target value in the URL can therefore inject SSH command-line flags rather than supplying a hostname.

Exploitation requires user interaction. The victim must click or otherwise activate a malicious scaleft:// link, typically delivered via phishing, a compromised web page, or a chat message. The attack complexity is high because the attacker must craft a URL that passes OPA parsing while still injecting a usable SSH flag.

Root Cause

The root cause is missing argument-boundary enforcement in the URL handler. Secure argument construction requires inserting -- before user-controlled positional values so that the CLI framework stops interpreting subsequent tokens as options. The OPA client omits this delimiter, allowing hyphen-prefixed values to be parsed as SSH options such as -o, -F, or -J.

Attack Vector

The attack vector is network-based with required user interaction. An attacker hosts or distributes a crafted scaleft:// link. When the target clicks the link, the operating system dispatches the URL to the OPA client, which builds an SSH command line containing attacker-controlled flags. Depending on which SSH options the attacker injects, the effect may include redirecting the connection through an attacker-controlled ProxyCommand, loading an alternate configuration file, or altering authentication behavior. See the Okta Security Advisory for CVE-2026-78635 for vendor technical details.

Detection Methods for CVE-2026-78635

Indicators of Compromise

scaleft:// URLs where the host or target segment begins with a hyphen (-)
SSH client processes spawned by the OPA client with unexpected flags such as -o ProxyCommand=, -F, or -J
Outbound SSH connections to hosts not present in the OPA resource inventory
Browser or mail client logs showing navigation to scaleft:// links from untrusted sources

Detection Strategies

Monitor process creation events for the OPA client launching ssh with argument tokens beginning with - immediately after the binary name
Alert on SSH child processes that include ProxyCommand, LocalCommand, or PermitLocalCommand options originating from OPA-initiated sessions
Inspect URL handler invocations and correlate scaleft:// activations with subsequent SSH command lines

Monitoring Recommendations

Enable command-line auditing on endpoints running the OPA client to capture full SSH invocations
Forward endpoint process telemetry to a centralized analytics platform for retroactive hunting on OPA-spawned SSH sessions
Review email and web proxy logs for inbound messages containing scaleft:// links from external senders

How to Mitigate CVE-2026-78635

Immediate Actions Required

Update the Okta Privileged Access client to the fixed version identified in the Okta Security Advisory for CVE-2026-78635
Inventory endpoints with the scaleft:// protocol handler registered and confirm patch status
Educate users to avoid clicking scaleft:// links from untrusted sources such as email, chat, or external websites

Patch Information

Okta has published a security advisory for CVE-2026-78635. Administrators should consult the vendor advisory for the specific fixed client version and apply the update through their standard OPA client distribution channels. No public exploit code has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Workarounds

Restrict or unregister the scaleft:// URL handler on endpoints that do not require it until the client is patched
Enforce web and email content filtering rules that strip or block scaleft:// links from external sources
Require users to initiate OPA SSH sessions from the client user interface rather than through browser-delivered URLs

bash

# Example: query the Windows registry to identify systems with the scaleft URL handler registered
reg query "HKEY_CLASSES_ROOT\scaleft" /s

# Example: on macOS, list applications registered for the scaleft scheme
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -dump | grep -i scaleft