CVE-2026-63378

HighCVSS 8.8

Published: 30/10/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Summary

In TAKO AI Agent for Okta prior to 3.0.1-beta, any authenticated user with a valid fctr_session cookie can submit arbitrary Python source in the script_code field of POST /api/react/execute-script without administrator privilege. The source is stored with skip_discovery=True, bypasses validate_generated_code (e.g. via dynamic getattr chains through __builtins__) and is executed by asyncio.create_subprocess_exec() as the application process user, root by default in the container.

Risk Assessment

Container compromise is possible, disclosing environment secrets (Okta API tokens, JWT key), the SQLite database, and enabling backend-service pivoting and persistence.

Recommendation

Update TAKO AI Agent for Okta to version 3.0.1-beta or later and run the application as a non-privileged user.

Other vulnerabilities in TAKO AI Agent for Okta

CVE-2026-63377Critical
In TAKO AI Agent for Okta prior to 3.0.1-beta, the POST /api/auth/setup endpoint allows an unauthenticated network attacker to create the first administrator account before the legitimate owner completes initial setup. The initial_setup function checks only the is_setup flag and requires no authentication, bootstrap token, or network restriction, and the default configuration listens on 0.0.0.0:8001.

Original NVD description (English source)

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `script_code` field of `POST /api/react/execute-script`, without administrator privilege. In `src/api/routers/react_stream.py`, the source is stored with `skip_discovery=True`, bypassing AI-based content filtering, and is passed to `validate_generated_code` in `src/utils/security_config.py`. `BLOCKED_PATTERNS` recognizes direct `__import__` calls but misses the import name passed as a string, `getattr` is in `ALLOWED_BUILTINS`, and the AST checker handles `ast.Name` and `ast.Attribute` targets but fails to handle `ast.Call` targets. Dynamic `getattr` call chains through `__builtins__` therefore evade validation. The `_write_temp_script` helper writes the accepted code to disk, and `asyncio.create_subprocess_exec()` executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through `GET /api/react/stream-react-updates?process_id=<id>`. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS