# CVE-2026-63378

Authenticated users can execute arbitrary Python, enabling container/root compromise.

- Page: https://www.vulneraibility.com/cve/CVE-2026-63378
- CVSS: 8.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.36% (percentile 29.9)
- Weakness: CWE-94
- Also known as: GHSA-r9q7-6784-7rc6
- Published: 2026-10-30

## Affected versions

- fctr-id okta-ai-agent: affected < 3.0.1-beta

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated RCE via POST /api/react/execute-script; attackers can gain container/root access, exfiltrate Okta tokens/DB, pivot and persist.

## Action

Immediate action required

## Recommendation

Upgrade to v3.0.1-beta immediately; or disable/remove agent and rotate credentials.

## References

- [other] https://github.com/fctr-id/okta-ai-agent/security/advisories/GHSA-r9q7-6784-7rc6
- [other] https://github.com/fctr-id/okta-ai-agent/commit/3b5ccaff8423cdfa6d26f5e133c01b8b71148df4
- [other] https://github.com/fctr-id/okta-ai-agent/releases/tag/v3.0.1-beta

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.