CVE-2026-63378

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid fctr_session cookie can submit arbitrary Python source in the script_code field of POST /api/react/execute-script, without administrator privilege. In src/api/routers/react_stream.py, the source is stored with skip_discovery=True, bypassing AI-based content filtering, and is passed to validate_generated_code in src/utils/security_config.py. BLOCKED_PATTERNS recognizes direct __import__ calls but misses the import name passed as a string, getattr is in ALLOWED_BUILTINS, and the AST checker handles ast.Name and ast.Attribute targets but fails to handle ast.Call targets. Dynamic getattr call chains through __builtins__ therefore evade validation. The _write_temp_script helper writes the accepted code to disk, and asyncio.create_subprocess_exec() executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through GET /api/react/stream-react-updates?process_id=<id>. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid fctr_session cookie can submit arbitrary Python source in the script_code field of POST /api/react/execute-script, without administrator privilege. In src/api/routers/react_stream.py, the source is stored with skip_discovery=True, bypassing AI-based content filtering, and is passed to validate_generated_code in src/utils/security_config.py. BLOCKED_PATTERNS recognizes direct __import__ calls but misses the import name passed as a string, getattr is in ALLOWED_BUILTINS, and the AST checker handles ast.Name and ast.Attribute targets but fails to handle ast.Call targets. Dynamic getattr call chains through __builtins__ therefore evade validation. The _write_temp_script helper writes the accepted code to disk, and asyncio.create_subprocess_exec() executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through GET /api/react/stream-react-updates?process_id=<id>. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid fctr_session cookie can submit arbitrary Python source in the script_code field of POST /api/react/execute-script, without administrator privilege. In src/api/routers/react_stream.py, the source is stored with skip_discovery=True, bypassing AI-based content filtering, and is passed to validate_generated_code in src/utils/security_config.py. BLOCKED_PATTERNS recognizes direct __import__ calls but misses the import name passed as a string, getattr is in ALLOWED_BUILTINS, and the AST checker handles ast.Name and ast.Attribute targets but fails to handle ast.Call targets. Dynamic getattr call chains through __builtins__ therefore evade validation. The _write_temp_script helper writes the accepted code to disk, and asyncio.create_subprocess_exec() executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through GET /api/react/stream-react-updates?process_id=<id>. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid fctr_session cookie can submit arbitrary Python source in the script_code field of POST /api/react/execute-script, without administrator privilege. In src/api/routers/react_stream.py, the source is stored with skip_discovery=True, bypassing AI-based content filtering, and is passed to validate_generated_code in src/utils/security_config.py. BLOCKED_PATTERNS recognizes direct __import__ calls but misses the import name passed as a string, getattr is in ALLOWED_BUILTINS, and the AST checker handles ast.Name and ast.Attribute targets but fails to handle ast.Call targets. Dynamic getattr call chains through __builtins__ therefore evade validation. The _write_temp_script helper writes the accepted code to disk, and asyncio.create_subprocess_exec() executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through GET /api/react/stream-react-updates?process_id=<id>. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.