{"id":"CVE-2026-63378","kind":"vulnerability","aliases":["CVE-2026-63378"],"related":[],"title":"TAKO AI Agent for Okta: any logged-in user runs Python as root","description":"TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `script_code` field of `POST /api/react/execute-script`, without administrator privilege. In `src/api/routers/react_stream.py`, the source is stored with `skip_discovery=True`, bypassing AI-based content filtering, and is passed to `validate_generated_code` in `src/utils/security_config.py`. `BLOCKED_PATTERNS` recognizes direct `__import__` calls but misses the import name passed as a string, `getattr` is in `ALLOWED_BUILTINS`, and the AST checker handles `ast.Name` and `ast.Attribute` targets but fails to handle `ast.Call` targets. Dynamic `getattr` call chains through `__builtins__` therefore evade validation. The `_write_temp_script` helper writes the accepted code to disk, and `asyncio.create_subprocess_exec()` executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through `GET /api/react/stream-react-updates?process_id=<id>`. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.","summary":"TAKO AI Agent for Okta lets any authenticated user with a session cookie submit Python code that the server writes to disk and executes. A weak AST and pattern filter can be bypassed with dynamic getattr chains, so an attacker runs code as root in the default container and can read Okta API tokens, the JWT key and the SQLite database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","docker","okta","python","self-hosted","tako-ai-agent"],"not_affected_if":["fixed-version","no-untrusted-users"],"how_to_check":"- Check the installed TAKO AI Agent for Okta version; affected builds are those before `3.0.1-beta`.\n- Look for the `POST /api/react/execute-script` route in your deployment and confirm whether it is reachable by non-admin users.\n- Confirm whether the app runs as root in its container (unknown from the sources beyond the default container user).","fix":"- TAKO AI Agent for Okta: upgrade to `3.0.1-beta` or later.","status":"open","published_at":"2026-10-30T23:17:14+00:00","first_seen_at":"2026-10-30T23:26:12+00:00","triaged_at":"2026-10-30T23:27:58+00:00","updated_at":"2026-10-30T23:27:58+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-30T23:27:58Z","model":"claude-haiku-5-5","output":{"fix":"- TAKO AI Agent for Okta: upgrade to `3.0.1-beta` or later.","reach":"network","title":"TAKO AI Agent for Okta: any logged-in user runs Python as root","impact":"high","summary":"TAKO AI Agent for Okta lets any authenticated user with a session cookie submit Python code that the server writes to disk and executes. A weak AST and pattern filter can be bypassed with dynamic getattr chains, so an attacker runs code as root in the default container and can read Okta API tokens, the JWT key and the SQLite database.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["okta","tako-ai-agent","python","self-hosted","docker"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"code runs as root in container; secrets and database readable","analyst_note":"Check the NVD entry and vendor advisory for affected-version ranges and whether the default container really runs as root.","how_to_check":"- Check the installed TAKO AI Agent for Okta version; affected builds are those before `3.0.1-beta`.\n- Look for the `POST /api/react/execute-script` route in your deployment and confirm whether it is reachable by non-admin users.\n- Confirm whether the app runs as root in its container (unknown from the sources beyond the default container user).","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","no-untrusted-users"],"who_is_affected":"Teams that run TAKO AI Agent for Okta with user accounts that can reach the execute-script endpoint are exposed; any authenticated user with a valid fctr_session cookie can exploit it without admin rights. Deployments on the fixed version or with no non-admin accounts are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4529,"output_tokens":653,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-63378':17A,20A '/api/react/execute-script':142C '/api/react/stream-react-updates':255C '3.0.1':119C,292C 'accept':222C 'administr':110C,144C 'agent':3A,33B,36B,97C,106C 'ai':2A,22B,32B,35B,96C,105C,158C 'ai-bas':157C 'ai-tool':21B 'allow':189C 'api':86B,268C 'applic':234C 'arbitrari':132C 'ast':60B,193C 'ast.attribute':198C 'ast.call':204C 'ast.name':196C 'asyncio.create':227C 'attack':73B 'authent':41B,122C 'backend':281C 'backend-servic':280C 'base':159C 'beta':120C,293C 'block':171C 'builtin':190C,211C 'bypass':66B,156C 'call':176C,208C 'chain':70B,209C 'checker':194C 'code':49B,75B,138C,168C,223C 'command':244C 'compromis':261C 'contain':81B,243C,260C 'content':160C 'cooki':46B,129C 'cve':15A,18A 'data':113C 'databas':94B,277C 'default':80B,242C 'direct':174C 'disclos':263C 'discoveri':154C 'disk':55B,225C 'docker':24B 'dynam':68B,206C 'environ':264C 'evad':213C 'event':252C 'exec':229C 'execut':57B,230C 'expos':274C 'fail':201C 'fctr':127C 'field':139C 'filter':63B,161C 'first':104C 'fix':289C 'generat':167C 'get':254C 'getattr':69B,186C,207C 'handl':195C,203C 'help':108C 'helper':219C 'host':29B 'id':257C 'import':175C,180C 'includ':266C 'issu':287C 'jwt':89B,272C 'key':90B,273C 'languag':116C 'let':39B 'local':103C 'local-first':102C 'log':8A 'logged-in':7A 'miss':178C 'name':181C 'natur':115C 'okta':5A,25B,38B,85B,99C,109C,267C 'output':245C 'pass':164C,182C 'pattern':62B,172C 'permit':279C 'persist':285C 'pivot':283C 'post':141C 'prior':117C 'privileg':145C 'process':235C,256C 'python':12A,26B,48B,133C 'queri':111C 'read':84B 'recogn':173C 'result':259C 'return':247C 'root':14A,77B,239C 'run':11A,74B 'script':137C,218C 'secret':265C 'self':28B 'self-host':27B 'sent':251C 'server':52B,250C 'server-s':249C 'servic':282C 'session':45B,128C 'skip':153C 'sourc':134C,149C 'sqlite':93B,276C 'src/api/routers/react_stream.py':147C 'src/utils/security_config.py':170C 'store':151C 'string':185C 'submit':47B,131C 'subprocess':228C 'tako':1A,31B,34B,95C 'tako-ai-ag':30B 'target':199C,205C 'temp':217C 'tenant':112C 'therefor':212C 'token':87B,269C 'tool':23B 'true':155C 'use':114C 'user':10A,42B,123C,236C 'valid':126C,166C,214C 'version':291C 'weak':59B 'without':143C 'write':53B,216C,220C","nicknames":[],"mitigations":[],"who_affected":"Teams that run TAKO AI Agent for Okta with user accounts that can reach the execute-script endpoint are exposed; any authenticated user with a valid fctr_session cookie can exploit it without admin rights. Deployments on the fixed version or with no non-admin accounts are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T23:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63378","severity":null,"published_at":"2026-10-30T23:17:14+00:00","modified_at":"2026-10-30T23:17:14+00:00","first_seen_at":"2026-10-30T23:26:12+00:00","fetched_at":"2026-10-30T23:26:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}