CVE-2026-94611 in authentik
Summary
by MITRE • 09/24/2026
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets. Affected configurations include one-time code delivery by mail or SMS, outbound provisioning targets, device trust integrations, identity sources, the Kubernetes outpost integration, applications using a client or shared secret, and applications using a proxy provider. Deployments are affected when view permission is granted to accounts that are not intended to read these credentials; deployments where every viewer is permitted to read them are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within the authentik identity provider represents a critical failure in access control logic regarding sensitive credential management. Authentik serves as an open-source solution for managing identities, authentication, and authorization across various enterprise environments. The core issue stems from how API serializers handle data serialization when retrieving configuration details. Specifically, prior to versions 2026.2.7, 2026.5.7, and 2026.8.2, the system incorrectly exposed stored credentials in its API responses. This exposure occurred whenever a user account possessed view permissions on an affected configuration object, regardless of whether that specific account had authorization to modify the configuration or access sensitive secrets associated with it.
This flaw affects several critical integration points within the authentik ecosystem where secret material is required for operational functionality. Affected configurations include one-time code delivery mechanisms via email or SMS, outbound provisioning targets used for synchronizing user data across systems, device trust integrations that verify endpoint security posture, identity sources connecting to external directories such as LDAP or Active Directory, and Kubernetes outpost integrations managing cluster access. Additionally, applications configured with client secrets, shared secrets, or those utilizing proxy providers are also susceptible. In these scenarios, the API serializer erroneously included plaintext credentials in its output payload rather than masking them or restricting their visibility based on granular secret-level permissions.
The operational impact of this vulnerability is severe for organizations relying on authentik for centralized identity management. An attacker with read-only access to configuration objects could extract sensitive authentication materials such as API keys, shared secrets, and connection strings. These credentials often serve as the primary means of authenticating services or applications against external systems. Compromise of these values allows unauthorized entities to impersonate legitimate services, potentially leading to data exfiltration, lateral movement within internal networks, or complete compromise of integrated third-party platforms. The risk is particularly acute in environments where broad view permissions are granted for administrative convenience without strict segregation of duties regarding secret access.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the secrets were improperly stored, though primarily it reflects a failure to enforce object-level security policies during data serialization. In terms of MITRE ATT&CK framework tactics, this flaw facilitates Credential Access by allowing adversaries to harvest valid authentication credentials from API responses without needing higher privileges or exploiting injection flaws. It also supports Discovery as attackers can enumerate sensitive configuration details about the identity infrastructure and its integrations.
To mitigate this risk, organizations must upgrade authentik to version 2026.2.7, 2026.5.7, or later immediately upon availability. For deployments that cannot be upgraded instantly, administrators should review user permissions and revoke view access on sensitive configuration objects from accounts that do not require such visibility. Implementing strict role-based access control policies ensures that only authorized personnel with explicit secret-reading privileges can access these configurations via the API. Regular auditing of permission assignments is recommended to prevent privilege creep and ensure alignment between operational needs and security requirements.