CVE-2026-63377criticalBroken access control2026-10-30

CVE-2026-63377 and CVE-2026-63378: TAKO AI Agent for Okta lets anyone grab the first admin account and any user run Python as root, upgrade to 3.0.1-beta

TAKO (okta-ai-agent), a self-hosted AI agent that lets Okta admins query their tenant in plain language, had two bugs before 3.0.1-beta. On a fresh install anyone who can reach port 8001 can create the first admin account, and any logged-in user can slip Python past the code validator and run it as root in the default container, exposing Okta API tokens and the JWT key.

01.

What it is

CVE-2026-63377: POST /api/auth/setup creates the first administrator without any authentication, bootstrap token or network restriction. It only checks whether setup is already done.

The default docker-compose.yml publishes port 8001 on all interfaces, so an attacker who reaches a new instance before the owner finishes setup becomes the only admin and locks the owner out. From there they can read Okta-synced user data, API tokens and chat history, and change the Okta integration credentials.

CVE-2026-63378: any user with a valid fctr_session cookie can send Python in the script_code field of POST /api/react/execute-script. The code skips the AI content filter and only goes through validate_generated_code, which dynamic getattr chains through __builtins__ get past.

The accepted script is written to disk and run as the app process user, which is root in the default container. That exposes environment secrets including Okta API tokens and the JWT key, plus the SQLite database.

02.

How to check

Check whether you run TAKO / okta-ai-agent and which version (3.0.0-beta is listed as affected).
Check whether port 8001 is reachable from other machines or the internet.
If an instance was exposed before you finished setup, check that the admin account is the one you created.

03.

How to fix

Upgrade to 3.0.1-beta or later.
Bind the published port to 127.0.0.1 or put the app behind your own authentication instead of exposing 8001 on all interfaces.
If you suspect someone else got in, rotate the Okta API token, the AI provider key and the JWT secret, and reinstall.

# docker-compose.yml: publish only on localhost
ports:
  - "127.0.0.1:8001:8001"

04.

Sources

More advisories for this tool