Live › vulnerability › CVE-2026-63378
TAKO AI Agent for Okta lets any authenticated user with a session cookie submit Python code that the server writes to disk and executes. A weak AST and pattern filter can be bypassed with dynamic getattr chains, so an attacker runs code as root in the default container and can read Okta API tokens, the JWT key and the SQLite database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 23:26 UTC. All times on this page are UTC.
Teams that run TAKO AI Agent for Okta with user accounts that can reach the execute-script endpoint are exposed; any authenticated user with a valid fctr_session cookie can exploit it without admin rights. Deployments on the fixed version or with no non-admin accounts are not affected.
No product ranges from the sources yet.
3.0.1-beta.POST /api/react/execute-script route in your deployment and confirm whether it is reachable by non-admin users.3.0.1-beta or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid fctr_session cookie can submit arbitrary Python source in the script_code field of POST /api/react/execute-script, without administrator privilege. In src/api/routers/react_stream.py, the source is stored with skip_discovery=True, bypassing AI-based content filtering, and is passed to validate_generated_code in src/utils/security_config.py. BLOCKED_PATTERNS recognizes direct __import__ calls but misses the import name passed as a string, getattr is in ALLOWED_BUILTINS, and the AST checker handles ast.Name and ast.Attribute targets but fails to handle ast.Call targets. Dynamic getattr call chains through __builtins__ therefore evade validation. The _write_temp_script helper writes the accepted code to disk, and asyncio.create_subprocess_exec() executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through GET /api/react/stream-react-updates?process_id=<id>. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.
This page as .md · .json · in your agent: get_signal("CVE-2026-63378")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.