CVE-2026-61574: authentik Information Disclosure Flaw

CVE-2026-61574 Overview

CVE-2026-61574 is a broken access control vulnerability [CWE-639] in authentik, an open-source identity provider. Versions prior to 2026.2.6 and 2026.5.5 expose every configured Remote Access Control endpoint to any authenticated user. The endpoint listing ignores per-application access controls, and connection responses include stored credentials for managed Remote Desktop Protocol (RDP), Secure Shell (SSH), and Virtual Network Computing (VNC) targets. The connection flow also fails to verify that an endpoint belongs to the application through which it was launched. Any authenticated user can read every endpoint together with its host and stored credentials, then open interactive sessions to systems they were never authorized to reach. Deployments that do not use the enterprise Remote Access Control provider are not affected.

Critical Impact
Authenticated users can retrieve stored RDP, SSH, and VNC credentials for all managed endpoints and establish interactive sessions to unauthorized systems.

Affected Products

authentik versions prior to 2026.2.6 (2026.2.x branch)
authentik versions prior to 2026.5.5 (2026.5.x branch)
Deployments using the enterprise Remote Access Control provider

Discovery Timeline

2026-08-18 - CVE-2026-61574 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-61574

Vulnerability Analysis

The vulnerability resides in the Remote Access Control (RAC) endpoint listing API in authentik. The list handler returns every configured endpoint to the requesting user without evaluating the policy bindings that gate access to each endpoint. The response payload also includes the connection settings object, which stores credentials used to authenticate to downstream RDP, SSH, and VNC targets. A second flaw compounds the exposure: when a client opens a connection, authentik does not confirm that the target endpoint is a member of the RAC application initiating the launch. An authenticated user with access to any single RAC application can therefore enumerate credentials and pivot to endpoints owned by other applications.

Root Cause

The root cause is missing authorization on an object reference [CWE-639]. The endpoint list serializer omits the policy engine check that applies elsewhere in authentik, and the connection launch flow does not validate the relationship between the requested endpoint and the parent application. Both are server-side authorization defects rather than authentication issues.

Attack Vector

Exploitation requires only a valid authenticated session on the authentik instance. The attacker calls the RAC endpoint listing API to enumerate all endpoints and extract stored credentials from the returned connection settings. The attacker then invokes the connection flow against any enumerated endpoint identifier, regardless of which RAC application governs it. See the GitHub Security Advisory GHSA-rv9x-92g6-9cpf for full technical details.

Detection Methods for CVE-2026-61574

Indicators of Compromise

Unexpected calls to the RAC endpoint list API from user accounts that historically only accessed a subset of applications.
Connection launch events targeting endpoint identifiers that do not belong to any RAC application the user is bound to.
Outbound RDP, SSH, or VNC sessions from the authentik outpost to hosts that a given user has no business reason to reach.

Detection Strategies

Audit authentik application and event logs for model_updated, authorize_application, and RAC connection events correlated against user-to-application policy bindings.
Alert on any single user account enumerating a high volume of distinct RAC endpoints within a short window.
Compare RAC connection targets against the expected application membership to identify cross-application access.

Monitoring Recommendations

Forward authentik audit logs to a centralized platform and retain them for post-incident review of credential access.
Monitor the outpost network egress for RDP, SSH, and VNC connections initiated on behalf of unusual principals.
Rotate and monitor any credentials stored in RAC connection settings for use outside the authentik outpost.

How to Mitigate CVE-2026-61574

Immediate Actions Required

Upgrade authentik to 2026.2.6 or 2026.5.5 as documented in the authentik 2026.2.6 release and authentik 2026.5.5 release.
Rotate all credentials stored in RAC connection settings, including RDP, SSH, and VNC credentials for managed targets.
Review authentik audit logs since the RAC provider was enabled to identify unauthorized endpoint access.

Patch Information

The issue is fixed in authentik 2026.2.6 and 2026.5.5. The patches enforce policy checks on the RAC endpoint listing API and validate that a launched endpoint belongs to the initiating RAC application. Refer to the GitHub Security Advisory GHSA-rv9x-92g6-9cpf for advisory details.

Workarounds

Disable the enterprise Remote Access Control provider until the upgrade is applied if immediate patching is not possible.
Restrict authentik user accounts to trusted operators while the RAC provider remains enabled on unpatched versions.
Remove stored credentials from RAC connection settings and require interactive credential entry where feasible.

bash

# Verify the running authentik server version
docker exec authentik-server ak version

# Example docker-compose upgrade to a fixed release
# Edit .env to set AUTHENTIK_TAG=2026.5.5 (or 2026.2.6), then:
docker compose pull
docker compose up -d