| Package | Affected versions | Patched versions |
|---|---|---|
| access gateway | < 2026.9.1 | 2026.9.1 |
The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free