CVE-2026-55106 in authentik
Summary
by MITRE • 08/18/2026
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the diagnostic action against a configured LDAP Source. The server then connects to the upstream directory using the source's configured bind credentials and returns a bounded set of directory entries. The response exposes the distinguished names of those entries and the names of the attributes present on them, revealing directory structure, naming conventions, and the existence of specific accounts and groups, but not attribute values. Deployments without a configured LDAP Source are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified within authentik prior to version 2026.2.6 and the 2026.5.5 release line represents a critical failure in access control enforcement for diagnostic endpoints associated with LDAP Source configurations. Authentik, functioning as an open-source identity provider, relies heavily on secure integration with external directory services such as Microsoft Active Directory or OpenLDAP to manage user authentication and authorization. The core technical flaw lies in the implementation of the LDAP Source API's diagnostic action, which was designed to assist administrators in troubleshooting connectivity issues by querying upstream directories. However, this specific endpoint failed to enforce the object-level read-authorization filters that are strictly applied to all other standard API operations within the application. This inconsistency creates a significant security gap where the principle of least privilege is violated, allowing actions intended for administrative diagnostics to be executed without proper verification of user permissions or authentication status.
From an operational perspective, this flaw allows any client capable of reaching the authentik API endpoint to invoke the diagnostic action against a configured LDAP Source. Crucially, this access includes unauthenticated clients who have not provided valid credentials or session tokens. Upon invocation, the server utilizes the bind credentials stored in its configuration for that specific LDAP source to establish a connection with the upstream directory service. While the application correctly restricts the response from returning sensitive attribute values such as passwords or email addresses, it inadvertently exposes metadata about the directory structure. The returned data includes the distinguished names of entries and the names of attributes present on those entries. This leakage provides an attacker with valuable intelligence regarding the internal architecture of the target organization's identity infrastructure, including naming conventions, organizational unit structures, and the existence of specific accounts or groups that may not be publicly visible through standard authentication flows.
The impact of this information disclosure is substantial within the context of a broader attack chain. By revealing directory structure and account names, an attacker can perform targeted reconnaissance to identify high-value targets such as service accounts, administrative users, or domain controllers. This knowledge facilitates more effective credential stuffing attacks, social engineering campaigns, or privilege escalation attempts against specific entities identified through this metadata leak. The vulnerability aligns with CWE-284 Improper Access Control and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor under the Common Weakness Enumeration framework. In terms of offensive security tactics, this behavior corresponds to ATT&CK technique T1087 Account Discovery, where adversaries gather information about accounts on local systems or in cloud environments to aid in further exploitation. The fact that unauthenticated access is possible elevates the severity from a simple configuration error to an external-facing vulnerability that can be exploited by any network actor with connectivity to the authentik instance.
Mitigation strategies must prioritize immediate patching and compensating controls if updates cannot be applied instantly. Organizations running affected versions of authentik should upgrade to version 2026.2.6 or later, which includes the necessary code changes to enforce read-authorization filters on all API endpoints including diagnostic actions. For deployments that are unable to update immediately due to operational constraints, network-level mitigation is essential. Administrators should ensure that the LDAP Source API endpoint is not exposed directly to untrusted networks by placing it behind a reverse proxy with strict authentication requirements or firewall rules that restrict access to authorized administrative IP ranges only. Additionally, implementing Web Application Firewall (WAF) rules can help detect and block anomalous requests targeting diagnostic endpoints from unknown sources. It is also advisable to review LDAP source configurations to ensure that bind credentials have minimal necessary permissions, limiting the potential scope of data exposure even if an attacker manages to exploit this vulnerability before a patch is applied. Deployments without any configured LDAP Source are inherently immune to this specific vector and do not require remediation for this issue.