CVE-2026-61574 in authentik
Summary
by MITRE • 08/18/2026
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain stored credentials. The endpoint listing does not apply the access controls governing the endpoints, and the connection flow does not confirm that an endpoint belongs to the Remote Access Control application through which it was launched. Any authenticated user can therefore read every endpoint together with its host and stored credentials and can open a connection to an endpoint belonging to another application. This exposes stored credentials for managed RDP, SSH, and VNC targets and grants interactive access to systems the user was never authorized to reach. Deployments that do not use the enterprise Remote Access Control provider are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified within authentik, an open-source identity provider platform, represents a critical failure in access control logic specifically affecting the Remote Access Control feature prior to version 2026.2.6 and 2026.5.5. This flaw allows any authenticated user to bypass intended authorization boundaries by querying the endpoint list API without restriction. Instead of returning only those remote desktop, SSH, or VNC endpoints that are explicitly associated with applications the user has been granted access to, the system returns a comprehensive list of all configured endpoints along with their connection settings. These settings frequently include stored credentials such as usernames and passwords required for authentication against target systems. This behavior effectively neutralizes the granular permission model designed into the application, allowing users to view infrastructure details that should remain invisible to them based on their role or group membership.
From a technical perspective, this issue stems from an improper implementation of object-level access controls within the backend logic handling remote connection requests. The API endpoint responsible for listing available targets fails to filter results based on the user's assigned application permissions. Furthermore, there is a lack of validation during the connection initiation phase that would verify whether the target endpoint belongs to the specific Remote Access Control application through which the request was launched. This architectural oversight means that an attacker can not only enumerate sensitive infrastructure data but also actively initiate connections to systems they have no business accessing. The absence of these checks creates a direct path for privilege escalation and unauthorized lateral movement within the organization's network environment, as the identity provider acts as a trusted gateway for remote access sessions.
The operational impact of this vulnerability is severe, encompassing both information disclosure and potential system compromise. By exposing stored credentials for managed RDP, SSH, and VNC targets, attackers gain immediate capability to authenticate against these systems without needing to crack passwords or exploit additional software vulnerabilities. This leads to a complete breach of confidentiality regarding sensitive data residing on those endpoints. Additionally, the ability to open interactive sessions grants unauthorized users full control over remote machines, enabling them to execute commands, install malware, exfiltrate data, or pivot further into internal networks. For organizations relying heavily on single sign-on and centralized identity management for secure remote access, this flaw undermines trust in the entire security posture by allowing any valid user account to potentially reach critical infrastructure assets.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if stored credentials are not properly encrypted or protected at rest, though the primary issue is the lack of authorization checks on API responses. In terms of attack vectors, it corresponds to ATT&CK technique T1078 Valid Accounts, as exploitation requires only valid authentication, and potentially T1552 Unsecured Credentials due to the exposure of stored secrets in plaintext or easily retrievable formats within the response payload. Mitigation strategies must prioritize immediate upgrading to version 2026.2.6 or later where these access control checks have been implemented correctly. For deployments that do not utilize the enterprise Remote Access Control provider, this specific vulnerability does not apply and no action is required regarding this issue. Organizations should also audit their current configurations to ensure that sensitive credentials stored within the identity provider are encrypted using strong cryptographic standards and rotate any passwords exposed during the window of exposure.