---
id: "CVE-2026-63378"
kind: "vulnerability"
aliases: ["CVE-2026-63378"]
title: "TAKO AI Agent for Okta: any logged-in user runs Python as root"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "docker", "okta", "python", "self-hosted", "tako-ai-agent"]
not_affected_if: ["fixed-version", "no-untrusted-users"]
published_at: "2026-10-30T23:17:14+00:00"
first_seen_at: "2026-10-30T23:26:12+00:00"
updated_at: "2026-10-30T23:27:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63378", "first_seen_at": "2026-10-30T23:26:12+00:00"}]
---

# TAKO AI Agent for Okta: any logged-in user runs Python as root

TAKO AI Agent for Okta lets any authenticated user with a session cookie submit Python code that the server writes to disk and executes. A weak AST and pattern filter can be bypassed with dynamic getattr chains, so an attacker runs code as root in the default container and can read Okta API tokens, the JWT key and the SQLite database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed TAKO AI Agent for Okta version; affected builds are those before `3.0.1-beta`.
- Look for the `POST /api/react/execute-script` route in your deployment and confirm whether it is reachable by non-admin users.
- Confirm whether the app runs as root in its container (unknown from the sources beyond the default container user).

## Fix

- TAKO AI Agent for Okta: upgrade to `3.0.1-beta` or later.

## Timeline

- 2026-10-30T23:26:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63378

## From the sources

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `script_code` field of `POST /api/react/execute-script`, without administrator privilege. In `src/api/routers/react_stream.py`, the source is stored with `skip_discovery=True`, bypassing AI-based content filtering, and is passed to `validate_generated_code` in `src/utils/security_config.py`. `BLOCKED_PATTERNS` recognizes direct `__import__` calls but misses the import name passed as a string, `getattr` is in `ALLOWED_BUILTINS`, and the AST checker handles `ast.Name` and `ast.Attribute` targets but fails to handle `ast.Call` targets. Dynamic `getattr` call chains through `__builtins__` therefore evade validation. The `_write_temp_script` helper writes the accepted code to disk, and `asyncio.create_subprocess_exec()` executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through `GET /api/react/stream-react-updates?process_id=<id>`. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_