Remote Code Execution in TAKO AI Agent for Okta
CVE-2026-63378

8.8HIGH

Key Information:

Vendor

Fctr-id

Status
Okta-ai-agent
Vendor
CVE Published:
30 October 2026

What is CVE-2026-63378?

The TAKO AI Agent for Okta allows authenticated users to submit arbitrary Python code via its API. This severe vulnerability allows users with a valid session cookie to exploit a flaw in the code execution validation process, potentially leading to unauthorized access. The compromised code can execute with root privileges within the application's container, risking exposure of sensitive information such as API tokens and database secrets. This issue has been mitigated in version 3.0.1-beta.

Affected Version(s)

okta-ai-agent < 3.0.1-beta

References

https://github.com/fctr-id/okta-ai-agent/security/advisor...
x_refsource_CONFIRM
https://github.com/fctr-id/okta-ai-agent/commit/3b5ccaff8...
x_refsource_MISC
https://github.com/fctr-id/okta-ai-agent/releases/tag/v3....
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.