CVE-2026-63377: Admin bypass in TAKO AI Agent for Okta

CVE-2026-63377 affects TAKO AI Agent for Okta, a tool that allows Okta administrators to query tenant data using natural language. The POST /api/auth/setup endpoint requires no authentication and is reachable on the network before initial setup is completed. Any attacker on the network can exploit this flaw to create the first administrator account, becoming the sole administrator of the system and preventing legitimate setup.

The flaw has a CVSS score of 9.8 (Critical) and allows the attacker to read Okta-synced data, API tokens, chat history, and application configuration. The attacker can also modify users, alter Okta integration credentials, lock out legitimate administrators, or completely disable the service. The flaw was fixed in version 3.0.1-beta, available since October 2026. Social signals indicate attention to the vulnerability, though the volume is still limited.

Administrators must immediately verify if TAKO AI Agent is in use within their infrastructure. If present, upgrade to version 3.0.1-beta or later as soon as possible. Check access logs on port 8001 for signs of unauthorized administrator account creation attempts. Also verify initial setup timestamps and confirm that only legitimate administrators are registered in the system. If deployment is in Docker, ensure that port 8001 is not exposed to untrusted networks.

The architecture compounds the risk: the default docker-compose.yml publishes port 8001 on all interfaces (0.0.0.0), the listener in Dockerfile is not restricted to localhost, and the authentication router in src/api/main.py is mounted without a global authentication guard. The initial_setup function only checks the setup completion flag without requiring a bootstrap token, network restrictions, or access to a legitimate Okta tenant.