CVE-2026-78623

Executive Summary

CVE-2026-78623 is a SQL injection vulnerability (CWE-89) in Okta Access Gateway affecting the "advanced mode" datastore configuration, where SAML assertion values are interpolated into database queries without sanitization prior to query preparation. Because the flaw is triggered by attacker-influenced SAML assertion content, any deployment that accepts SAML assertions from an identity provider an attacker can influence — or that permits a low-privileged authenticated user to craft assertion attributes — is exposed. Successful exploitation permits unintended SQL execution against the configured backend database, with a high confidentiality impact (CVSS C:H) and reduced integrity/availability impact (I:L/A:L), for a base score of 7.7.

Technical Analysis

Okta Access Gateway is a reverse-proxy/identity-bridging component that federates authentication to on-premises applications (e.g., header-based or legacy web apps) using SAML assertions issued by an Okta org or other IdP. The vulnerability resides in the advanced mode datastore configuration, a feature in which administrators define custom database queries for user lookup or attribute resolution. In this mode, the product constructs a query string and then "prepares" it — but the vulnerable flow performs string interpolation of SAML assertion values into the query text before the query is prepared/submitted to the database driver.

The critical defect is the ordering and the absence of parameterization:

1. A SAML assertion value (attribute, NameID, or similar assertion-derived string) is received.
2. That value is concatenated/interpolated directly into a database query string.
3. The fully formed string is then handed to the database as the (already-malicious) query.

Because the unsanitized value is substituted prior to preparation, the value is not bound as a parameter; it becomes part of the SQL statement grammar. This means attacker-controlled assertion content can alter query structure, not merely data, resulting in unintended SQL execution against the configured backend database.

The CVSS vector is highly informative about the attack profile:

• AV:N — reachable over the network; the attacker does not need local access.
• AC:H — high attack complexity, consistent with the need to control or influence a SAML assertion/attribute path, and to know or trigger the advanced-mode datastore query path.
• PR:L — low privileges required; the attacker needs some authenticated foothold or the ability to supply an assertion, but not administrative rights.
• UI:N — no user interaction.
• S:C — scope change: the exploited component (Access Gateway's query construction) impacts a resource governed by a different security authority — the backend database. This is why the score reaches 7.7 despite the reduced I/A impact.
• C:H / I:L / A:L — primary impact is data disclosure; write/availability effects are limited, generally consistent with an injection primitive on a datastore used for attribute/lookup resolution rather than bulk data modification.

Root cause class: classic string-concatenation / pre-preparation interpolation SQL injection (CWE-89). The distinguishing nuance is the source of tainted data — SAML assertion values — which places the injection point in the trust boundary between a federated identity assertion and the backend datastore query layer.

Attack surface: the SAML assertion processing path feeding the advanced-mode datastore configuration. The flaw is only exploitable where advanced mode datastore querying is configured and where the attacker can influence assertion content. No specific function names, endpoints, parameters, or file paths are disclosed in the available NVD data; the above is derived strictly from the published description.

Exploitation Scenarios

No public PoC or exploit code is available (POC: Public status reflects registration, but Exploit Code: NO and Nuclei Template: NO). The attack chain below is inferred from the vulnerability class (CWE-89) and the published description, at the vulnerability-class level. No specific function names, endpoints, or parameter names are asserted.

1. Reconnaissance / target identification. An adversary identifies an Okta Access Gateway deployment in scope and determines whether the advanced-mode datastore configuration is in use (custom database queries for lookups/attributes). Fingerprinting targets the Access Gateway surface; deployments integrating with a backend SQL database via custom queries are the relevant targets.

2. Trigger condition for the flaw class. The attacker must cause a SAML assertion value to flow into the advanced-mode query path. This is consistent with the CVSS PR:L / AC:H profile: a low-privileged actor or an assertion-injecting party supplies a crafted assertion whose attribute value reaches the query-construction logic. Because sanitization is absent before interpolation, the crafted value is not neutralized.

3. Payload / execution method (class level). The attacker embeds SQL metacharacters and SQL syntax within an assertion value. Since the value is substituted into the query string prior to preparation, it is interpreted as SQL grammar rather than bound data. The crafted query then executes against the configured backend database. The exact payload syntax depends on the backend database vendor and the surrounding query context, which are not disclosed.

4. Post-exploitation impact. The result is "unintended SQL execution against the configured backend database." Given the CVSS profile (C:H, I:L, A:L, scope change), the realistic outcome is exfiltration of data accessible via the configured query path — frequently identity/attribute data or credentials-adjacent records resolvable through the datastore lookup. Because scope is changed, impact lands on the backend database's security domain, which may extend blast radius beyond Access Gateway itself.

Note: the exploitation precondition (influence over assertion values reaching the advanced-mode datastore query) may substantially narrow the exploitable population, consistent with AC:H. No exploit-in-the-wild evidence is available at time of analysis.

Impact Assessment

• Confidentiality: High. The primary impact is unauthorized read of backend database content through manipulated queries. For an identity integration component, exposed data may include user attributes, identity records, or datastore-resolved secrets.
• Integrity: Low. Limited ability to modify data — typical of a query path scoped to lookups/attribute resolution rather than broad write operations.
• Availability: Low. Minor availability effects against the configured backend database.
• Scope: Changed. The vulnerable component and the impacted component (backend database) are governed by different security authorities, meaning compromise can pivot from the Access Gateway trust domain into the datastore's domain.

Business impact: Organizations running Okta Access Gateway with advanced-mode datastore configuration that interpolate SAML assertion values into queries face potential disclosure of backend identity/datastore data. Identity data exfiltration can enable downstream account takeover, so even a "low" integrity/availability impact should be treated seriously in an identity context. Blast radius is bounded by (a) whether advanced mode is configured, (b) what the backend database exposes to that query, and (c) the attacker's ability to influence assertion values.

CVSS: 7.7 (High) — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L. EPSS: 0.00238 (~15.1th percentile) — low near-term exploitation probability estimate. CISA KEV: Not listed. No confirmed in-the-wild exploitation.

Detection Guidance

Sigma Rule

title: Suspicious SQL Metacharacters in SAML Assertion Values (Okta Access Gateway)
id: 8f2c1a44-7b6e-4d1f-9c3a-78623cve0001
status: experimental
description: Detects SQL injection indicators in SAML assertion-derived values reaching the Okta Access Gateway advanced-mode datastore query path (CVE-2026-78623).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78623
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: okta
  service: access_gateway
detection:
  selection_keywords:
    - "' OR "
    - "UNION SELECT"
    - "';--"
    - "/*"
    - "xp_cmdshell"
    - "SLEEP("
    - "WAITFOR DELAY"
  selection_context:
    - assertion
    - datastore
    - advanced
    - query
  condition: selection_keywords and selection_context
falsepositives:
  - Legitimate assertions containing SQL-like literals in free-text attributes
level: high
tags:
  - attack.t1190
  - cwe.89

YARA Rule

rule CVE_2026_78623_SAML_SQLi_Indicators
{
    meta:
        description = "Detects SQL injection patterns in SAML assertion payloads targeting Okta Access Gateway advanced-mode datastore queries (CVE-2026-78623)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78623"
        date = "2026-01-01"
        severity = "high"

    strings:
        $saml = "<Assertion" ascii nocase
        $attr = "AttributeValue" ascii nocase
        $sqli1 = "UNION SELECT" ascii nocase
        $sqli2 = "' OR " ascii nocase
        $sqli3 = "';--" ascii
        $sqli4 = "WAITFOR DELAY" ascii nocase
        $sqli5 = "SLEEP(" ascii nocase
        $sqli6 = "xp_cmdshell" ascii nocase

    condition:
        $saml and $attr and 1 of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78623 Okta Access Gateway SAML Assertion SQL Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"SAMLResponse"; http.request_body; content:"UNION SELECT"; nocase; http.request_body; content:"' OR "; nocase; classtype:web-application-attack; reference:cve,2026-78623; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78623; sid:202678623; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [authentication where event.outcome == "success" and saml.assertion != null]
  [any where event.category == "database" and
     wildcard(query.text, "*UNION SELECT*") or
     wildcard(query.text, "*' OR *") or
     wildcard(query.text, "*WAITFOR DELAY*")]

Splunk SPL Query

index=okta OR index=access_gateway sourcetype=okta:access_gateway
(saml_response="*UNION SELECT*" OR saml_response="*' OR *" OR saml_response="*';--*"
 OR assertion_value="*WAITFOR DELAY*" OR assertion_value="*SLEEP(*"
 OR datastore_query="*UNION*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as source_ips values(assertion_value) as payloads
        by user, dest
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="okta,access_gateway,sql_injection,">
  <rule id="2026786" level="12">
    <decoded_as>json</decoded_as>
    <field name="saml_response">\.*\b(UNION\s+SELECT|WAITFOR\s+DELAY|xp_cmdshell|'\s+OR\s+)\b</field>
    <description>CVE-2026-78623: SQL injection indicators in Okta Access Gateway SAML assertion values</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_78623,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source, NVD, claims a patch exists; this is not independently confirmed, and no patch version/build identifier or vendor advisory is available).

1. Immediate mitigations (no confirmed patch):

   • If the advanced-mode datastore configuration is not required, disable it, or restrict it to deployments where SAML assertion values cannot introduce SQL content.
   • Restrict which identities/attributes can reach the advanced-mode datastore query path; reduce the population of actors capable of supplying assertion values (directly addressing the PR:L precondition).
   • Apply least privilege to the backend database account used by Access Gateway so that even if injection occurs, the achievable SQL effect is minimized (limits the C:H exposure).
   • Monitor and alert on SQL metacharacters arriving in SAML assertion values using the detection rules above.

2. Patch / upgrade steps:

   • Because patch confidence is only 2/4 (CLAIMED via NVD), do not assume patched status from the NVD entry alone. Contact Okta support / consult the official Okta Access Gateway security advisories and release notes to obtain the specific fixed build. Verify a remediation release exists and is explicitly documented before treating the environment as remediated.
   • Stage the update in a non-production deployment first; validate advanced-mode datastore queries and SAML integrations after upgrading.

3. Long-term hardening:

   • Ensure datastore queries use parameterized/prepared statements where the parameterization is applied before any interpolation — i.e., bind assertion-derived values as parameters, never as query text.
   • Enforce server-side validation/allow-listing of SAML assertion attribute values; reject values containing SQL control characters.
   • Network-segment Access Gateway from backend databases and enforce strict DB account least privilege.
   • Maintain continuous monitoring for the injection indicators with the provided Sigma/YARA/Suricata/Elastic/Splunk/Wazuh rules.

References

1. NVD — CVE-2026-78623: https://nvd.nist.gov/vuln/detail/CVE-2026-78623
2. Okta Security Advisories / Trust site (Okta Access Gateway advisories and release notes): https://trust.okta.com/
3. MITRE CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): https://cwe.mitre.org/data/definitions/89.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-78623 not currently listed)

Threat actor / exploit-in-the-wild evidence: None available. No CISA KEV listing, no exploit code, no Nuclei template, and an EPSS score of 0.00238 (~15.1th percentile) all indicate no confirmed in-the-wild exploitation at time of analysis.