CVE-2026-78635 PUBLISHED

Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument

Assigner: Okta
Reserved: 24.08.2026 Published: 08.09.2026 Updated: 08.09.2026

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS Score: 5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Okta
Product	Okta Privileged Access Client
Versions	Default: unaffected affected from 1.18.0 to 1.113.0 (excl.)

Solutions

Upgrade the Okta Privileged Access client to version 1.113.0.

References

https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-privileged-access-ssh-client-url-handler-argument-cve-2026-78635

Problem Types

Improper Neutralization of Argument Delimiters in a Command