Unable to Access Okta Access Gateway Applications after Upgrade to 2026.9.2 or 2026.44.0

After upgrading to Okta Access Gateway (OAG) 2026.9.2 or 2026.44.0, an application fails to resolve, fails to respond, or generates a 5xx error. This occurs because a DNS handling improvement overwrites a resolved IPv4 address when the request returns nodata for IPv6. Upgrading the OAG appliance to 2026.44.1 or later resolves the issue.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG) 2026.9.2
• Okta Access Gateway (OAG) 2026.44.0

An improvement in OAG DNS handling released in version 2026.9.2 overwrites a resolved IPv4 address when the request returns nodata for IPv6. This issue occurs only in specific environments.

What indicates a Domain Name System resolution issue?

Retrieve the protected web resource hostname from the Admin Console based on the load balancing configuration and execute the nslookup command in the appliance shell to verify the resolution.

1. Open the affected application in the Admin Console and retrieve the protected web resource hostname.
2. Retrieve the hostname value from the provided locations based on the OAG load balancing configuration.

   • For environments without OAG load balancing.

1. • For environments with OAG load balancing.
      
     
2. Sign in to the appliance shell and run the following command to verify the protected resource resolution.

nslookup <protected_resource>

The output shows one or multiple entries, one of which contains a spoof IP address of 0.0.0.2. Running a curl command on the protected resource also resolves it to the spoof IP address.

4. Verify that the DNS resolves properly by executing the command again using the configured DNS server.

nslookup <protected_resource> <DNS_Server>

If the DNS resolves and provides an IP address for the request, OAG experiences the issue.

Upgrading Okta Access Gateway resolves the issue.

Upgrade OAG to version 2026.44.1 or later using the official documentation and verify the protected resource resolution by executing the nslookup command in the appliance shell.

1. Upgrade to 2026.44.1 or later using the instructions from the Okta Access Gateway Installation Documentation.
2. Sign in to the appliance shell and check the affected protected resource to verify it resolves correctly by running the following command.

nslookup <protected_resource>