CVE-2026-63378

TAKO script replay bypasses Python validation

fctr-id · TAKO AI Agent for Okta

First documented disclosure · Review checkpoint

Summary

An ordinary authenticated session can execute server-side Python.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled container reproduction; real-world exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Dynamic call chains bypass regex/AST restrictions in a client-script replay endpoint that skips AI filtering.

Conditions required

Any valid application session and access to the replay API; administrator privileges are unnecessary.

Potential impact

Process-level code execution and readable secrets; default-container root access is not proof of host escape.

Affected versions and configurations

CNA: <3.0.1-beta; maintainer reproduction targets 3.0.0-beta.

Fix and mitigation status

3.0.1-beta.

Practical next steps

Upgrade to the release disabling direct client replay and running the container without root privileges.

Operating lesson

Blocklists and model filtering cannot substitute for isolating executable user input.

Evidence and limits

June 30 original advisory precedes October 30 CVE publication. This is separate from first-run takeover CVE-2026-63377, even though one test chains setup and replay.

Sources