{"id":"CVE-2026-63377","kind":"vulnerability","aliases":["CVE-2026-63377"],"related":[],"title":"TAKO AI Agent for Okta: unauthenticated first-admin setup lets attackers take over","description":"TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticated network attacker to create the first administrator account before the legitimate owner completes initial setup. The `initial_setup` function checks only the `is_setup` completion flag and requires no authentication, one-time bootstrap token, or network restriction. The default `docker-compose.yml` publishes port 8001 on all interfaces, the `Dockerfile` starts the listener on 0.0.0.0, and `src/api/main.py` mounts the authentication router without a global authentication guard. The endpoint invokes `create_auth_user` with `UserRole.ADMIN` and `set_auth_cookie`, issuing a valid `fctr_session` JWT cookie. Localhost-only CORS rules do not restrict non-browser HTTP clients, and the setup operation does not require access to a real Okta tenant. The attacker becomes the sole administrator and prevents legitimate first-run setup, can read Okta-synced user data, API tokens, chat history, and application configuration, modify users and Okta integration credentials, and lock out administrators or disable the service. Already completed setup is rejected. This issue is fixed in version 3.0.1-beta.","summary":"Before 3.0.1-beta, the TAKO AI Agent for Okta exposes a setup endpoint that lets any network client create the first administrator account before the owner runs initial setup. The attacker then gets a valid admin session and can read Okta-synced user data, API tokens, chat history and integration credentials.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agent","ai-tooling","docker","okta","self-hosted"],"not_affected_if":["not-network-reachable","setup-already-completed-and-port-restricted","version-3.0.1-beta-or-later"],"how_to_check":"- Check the deployed version; affected builds are those before `3.0.1-beta`.\n- Check whether `/api/auth/setup` answers on port `8001` from a host outside your network, and whether setup has been completed.\n- Check whether `docker-compose.yml` publishes port `8001` on all interfaces.","fix":"- Upgrade to `3.0.1-beta` or later.","status":"open","published_at":"2026-10-30T23:17:14+00:00","first_seen_at":"2026-10-30T23:26:12+00:00","triaged_at":"2026-10-30T23:27:58+00:00","updated_at":"2026-10-30T23:27:58+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-30T23:27:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `3.0.1-beta` or later.","reach":"network","title":"TAKO AI Agent for Okta: unauthenticated first-admin setup lets attackers take over","impact":"high","summary":"Before 3.0.1-beta, the TAKO AI Agent for Okta exposes a setup endpoint that lets any network client create the first administrator account before the owner runs initial setup. The attacker then gets a valid admin session and can read Okta-synced user data, API tokens, chat history and integration credentials.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["okta","self-hosted","docker","ai-agent"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker becomes sole admin, reads Okta data and API tokens","analyst_note":"","how_to_check":"- Check the deployed version; affected builds are those before `3.0.1-beta`.\n- Check whether `/api/auth/setup` answers on port `8001` from a host outside your network, and whether setup has been completed.\n- Check whether `docker-compose.yml` publishes port `8001` on all interfaces.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.0.1-beta-or-later","not-network-reachable","setup-already-completed-and-port-restricted"],"who_is_affected":"Teams running the TAKO AI Agent for Okta before 3.0.1-beta, especially the default Docker deployment that publishes port 8001 on all interfaces. Exposure is highest where the service is reachable from untrusted networks before the owner completes first-run setup; deployments already set up and not reachable from outside the network are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000762,"input_tokens":4487,"output_tokens":627,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-63377':16A,19A '/api/auth/setup':110C '0.0.0.0':169C '3.0.1':32B,107C,278C '8001':159C 'access':220C 'account':53B,123C 'admin':9A,66B 'administr':52B,98C,122C,231C,262C 'agent':3A,22B,37B,85C,94C 'ai':2A,21B,24B,36B,84C,93C 'ai-ag':20B 'ai-tool':23B 'allow':113C 'alreadi':267C 'api':76B,246C 'applic':251C 'attack':12A,61B,117C,227C 'auth':185C,191C 'authent':145C,174C,179C 'becom':228C 'beta':33B,108C,279C 'bootstrap':149C 'browser':210C 'chat':78B,248C 'check':135C 'client':48B,212C 'complet':128C,140C,268C 'configur':252C 'cooki':192C,199C 'cor':203C 'creat':49B,119C,184C 'credenti':82B,258C 'cve':14A,17A 'data':75B,101C,245C 'default':155C 'disabl':264C 'docker':26B 'docker-compose.yml':156C 'dockerfil':164C 'endpoint':43B,182C 'expos':40B 'fctr':196C 'first':8A,51B,92C,121C,236C 'first-admin':7A 'first-run':235C 'fix':275C 'flag':141C 'function':134C 'get':63B 'global':178C 'guard':180C 'help':96C 'histori':79B,249C 'host':30B 'http':211C 'initi':58B,129C,132C 'integr':81B,257C 'interfac':162C 'invok':183C 'issu':193C,273C 'jwt':198C 'languag':104C 'legitim':126C,234C 'let':11A,45B 'listen':167C 'local':91C 'local-first':90C 'localhost':201C 'localhost-on':200C 'lock':260C 'modifi':253C 'mount':172C 'natur':103C 'network':47B,116C,152C 'non':209C 'non-brows':208C 'okta':5A,27B,39B,72B,87C,97C,224C,242C,256C 'okta-sync':71B,241C 'one':147C 'one-tim':146C 'oper':216C 'owner':56B,127C 'port':158C 'post':109C 'prevent':233C 'prior':105C 'publish':157C 'queri':99C 'read':70B,240C 'real':223C 'reject':271C 'requir':143C,219C 'restrict':153C,207C 'router':175C 'rule':204C 'run':57B,237C 'self':29B 'self-host':28B 'servic':266C 'session':67B,197C 'set':190C 'setup':10A,42B,59B,130C,133C,139C,215C,238C,269C 'sole':230C 'src/api/main.py':171C 'src/api/routers/auth.py':112C 'start':165C 'sync':73B,243C 'take':13A 'tako':1A,35B,83C 'tenant':100C,225C 'time':148C 'token':77B,150C,247C 'tool':25B 'unauthent':6A,115C 'use':102C 'user':74B,186C,244C,254C 'userrole.admin':188C 'valid':65B,195C 'version':277C 'without':176C","nicknames":[],"mitigations":[],"who_affected":"Teams running the TAKO AI Agent for Okta before 3.0.1-beta, especially the default Docker deployment that publishes port 8001 on all interfaces. Exposure is highest where the service is reachable from untrusted networks before the owner completes first-run setup; deployments already set up and not reachable from outside the network are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T23:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63377","severity":null,"published_at":"2026-10-30T23:17:14+00:00","modified_at":"2026-10-30T23:17:14+00:00","first_seen_at":"2026-10-30T23:26:12+00:00","fetched_at":"2026-10-30T23:26:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}