goauthentik up to 2026.2.5/2026.5.4 access control

Summaryinfo

A vulnerability has been found in goauthentik authentik up to 2026.2.5/2026.5.4 and classified as critical. The impacted element is an unknown function. This manipulation causes access control. The identification of this vulnerability is CVE-2026-61574. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in goauthentik authentik up to 2026.2.5/2026.5.4. It has been declared as critical. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain stored credentials. The endpoint listing does not apply the access controls governing the endpoints, and the connection flow does not confirm that an endpoint belongs to the Remote Access Control application through which it was launched. Any authenticated user can therefore read every endpoint together with its host and stored credentials and can open a connection to an endpoint belonging to another application. This exposes stored credentials for managed RDP, SSH, and VNC targets and grants interactive access to systems the user was never authorized to reach. Deployments that do not use the enterprise Remote Access Control provider are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-61574 since 07/10/2026. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 2026.2.6 or 2026.5.5 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• goauthentik

Name

• authentik

Version

• 2026.2.0
• 2026.2.1
• 2026.2.2
• 2026.2.3
• 2026.2.4
• 2026.2.5
• 2026.5.0
• 2026.5.1
• 2026.5.2
• 2026.5.3
• 2026.5.4

Website

• Product: https://github.com/goauthentik/authentik/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion