CVE-2026-55106
Received Received - Intake

Information Disclosure in Authentik LDAP Source API

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the diagnostic action against a configured LDAP Source. The server then connects to the upstream directory using the source's configured bind credentials and returns a bounded set of directory entries. The response exposes the distinguished names of those entries and the names of the attributes present on them, revealing directory structure, naming conventions, and the existence of specific accounts and groups, but not attribute values. Deployments without a configured LDAP Source are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-55106
EUVD
EUVD-2026-61061

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
goauthentik authentik 2026.2.6
goauthentik authentik 2026.5.5
goauthentik authentik to 2026.2.6 (exc)
goauthentik authentik to 2026.5.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55106 is a vulnerability in the authentik identity provider where the LDAP Source debug endpoint lacks proper authorization checks. This allows any client, including unauthenticated users, to access diagnostic information about LDAP directory structures if they can reach the API. The flaw exposes directory structure details like distinguished names and attribute names but not actual attribute values such as passwords.

Detection Guidance

To detect this vulnerability, check if the LDAP Source debug endpoint in authentik is accessible without proper authorization. Use network scanning tools like curl to query the endpoint. Example: curl -v http://<authentik-server>/api/v3/sources/ldap/<source-id>/debug/. If the endpoint responds with directory structure details without authentication, the system is vulnerable.

Impact Analysis

This vulnerability could allow unauthorized parties to gather information about your LDAP directory structure, including account and group names. While it does not expose sensitive data like passwords, it may help attackers identify potential targets or understand your directory layout, increasing the risk of further attacks if combined with other vulnerabilities.

Compliance Impact

This vulnerability may impact compliance by exposing directory structure and account existence, which could be considered a breach of data confidentiality under GDPR or HIPAA. While no direct attribute values are exposed, the disclosure of organizational structure could violate privacy principles requiring protection of personal data.

Mitigation Strategies

Immediately restrict external access to the LDAP Source debug API endpoint using reverse proxy or firewall rules. Upgrade authentik to versions 2026.2.6 or 2026.5.5 or later to apply the security patch. Monitor logs for unauthorized access attempts to the debug endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55106. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart