Description
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `script_code` field of `POST /api/react/execute-script`, without administrator privilege. In `src/api/routers/react_stream.py`, the source is stored with `skip_discovery=True`, bypassing AI-based content filtering, and is passed to `validate_generated_code` in `src/utils/security_config.py`. `BLOCKED_PATTERNS` recognizes direct `__import__` calls but misses the import name passed as a string, `getattr` is in `ALLOWED_BUILTINS`, and the AST checker handles `ast.Name` and `ast.Attribute` targets but fails to handle `ast.Call` targets. Dynamic `getattr` call chains through `__builtins__` therefore evade validation. The `_write_temp_script` helper writes the accepted code to disk, and `asyncio.create_subprocess_exec()` executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through `GET /api/react/stream-react-updates?process_id=<id>`. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.
Published: 2026-10-30
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution via authenticated Python execution
Action: Patch Immediately
AI Analysis

Impact

TAKO AI Agent for Okta allows authenticated non‑admin users to submit arbitrary Python code through the /api/react/execute-script endpoint. The validator bypasses AI‑based content filtering because it fails to reject string‑based imports and allows getattr chains, letting attackers import system modules. The accepted code is written to disk and executed as the container’s root user, resulting in full container compromise and disclosure of secrets such as Okta API tokens and the JWT key as well as access to the SQLite database.

Affected Systems

The flaw exists in fctr‑id’s Okta AI Agent in all versions prior to v3.0.1‑beta. Any deployment running a legacy version with users who possess a valid fctr_session cookie is vulnerable.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity. EPSS is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is an authenticated API endpoint; attackers need only legitimate user credentials, which are routinely available to Okta administrators, to inject and execute code, gaining persistent container access and the ability to pivot within the backend.

Generated by OpenCVE AI on October 30, 2026 at 23:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Okta AI Agent to version 3.0.1‑beta or later.
  • If an upgrade is not immediately possible, disable the /api/react/execute-script endpoint or restrict it to administrator users only.
  • Configure the container to run the application process as a non‑root user to limit the impact of any code execution.
  • Enhance the code validation logic to reject string‑based imports and disallow getattr chains that access built‑ins.

Generated by OpenCVE AI on October 30, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Description TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `script_code` field of `POST /api/react/execute-script`, without administrator privilege. In `src/api/routers/react_stream.py`, the source is stored with `skip_discovery=True`, bypassing AI-based content filtering, and is passed to `validate_generated_code` in `src/utils/security_config.py`. `BLOCKED_PATTERNS` recognizes direct `__import__` calls but misses the import name passed as a string, `getattr` is in `ALLOWED_BUILTINS`, and the AST checker handles `ast.Name` and `ast.Attribute` targets but fails to handle `ast.Call` targets. Dynamic `getattr` call chains through `__builtins__` therefore evade validation. The `_write_temp_script` helper writes the accepted code to disk, and `asyncio.create_subprocess_exec()` executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through `GET /api/react/stream-react-updates?process_id=<id>`. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.
Title TAKO AI Agent for Okta: Authenticated Python execution through validator bypass
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-30T22:19:39.743Z

Reserved: 2026-07-16T17:39:30.170Z

Link: CVE-2026-63378

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T23:17:14.410

Modified: 2026-10-30T23:17:14.410

Link: CVE-2026-63378

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T23:30:15Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')