Live › vulnerability › CVE-2026-63377
Before 3.0.1-beta, the TAKO AI Agent for Okta exposes a setup endpoint that lets any network client create the first administrator account before the owner runs initial setup. The attacker then gets a valid admin session and can read Okta-synced user data, API tokens, chat history and integration credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 23:26 UTC. All times on this page are UTC.
Teams running the TAKO AI Agent for Okta before 3.0.1-beta, especially the default Docker deployment that publishes port 8001 on all interfaces. Exposure is highest where the service is reachable from untrusted networks before the owner completes first-run setup; deployments already set up and not reachable from outside the network are less exposed.
No product ranges from the sources yet.
3.0.1-beta./api/auth/setup answers on port 8001 from a host outside your network, and whether setup has been completed.docker-compose.yml publishes port 8001 on all interfaces.3.0.1-beta or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, POST /api/auth/setup in src/api/routers/auth.py allows an unauthenticated network attacker to create the first administrator account before the legitimate owner completes initial setup. The initial_setup function checks only the is_setup completion flag and requires no authentication, one-time bootstrap token, or network restriction. The default docker-compose.yml publishes port 8001 on all interfaces, the Dockerfile starts the listener on 0.0.0.0, and src/api/main.py mounts the authentication router without a global authentication guard. The endpoint invokes create_auth_user with UserRole.ADMIN and set_auth_cookie, issuing a valid fctr_session JWT cookie. Localhost-only CORS rules do not restrict non-browser HTTP clients, and the setup operation does not require access to a real Okta tenant. The attacker becomes the sole administrator and prevents legitimate first-run setup, can read Okta-synced user data, API tokens, chat history, and application configuration, modify users and Okta integration credentials, and lock out administrators or disable the service. Already completed setup is rejected. This issue is fixed in version 3.0.1-beta.
This page as .md · .json · in your agent: get_signal("CVE-2026-63377")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.