CVE-2026-61574

Received Received - Intake

Information Disclosure in Authentik Remote Access

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain stored credentials. The endpoint listing does not apply the access controls governing the endpoints, and the connection flow does not confirm that an endpoint belongs to the Remote Access Control application through which it was launched. Any authenticated user can therefore read every endpoint together with its host and stored credentials and can open a connection to an endpoint belonging to another application. This exposes stored credentials for managed RDP, SSH, and VNC targets and grants interactive access to systems the user was never authorized to reach. Deployments that do not use the enterprise Remote Access Control provider are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-61574

EUVD

EUVD-2026-61060

Affected Vendors & Products

Vendor	Product	Version / Range
goauthentik	authentik	to 2026.2.6 (inc)
goauthentik	authentik	to 2026.5.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

The vulnerability in authentik allows any authenticated user to list all configured Remote Access Control endpoints and their stored credentials, even if they lack permissions for those applications. This bypasses access controls, exposing sensitive credentials for RDP, SSH, and VNC targets and enabling unauthorized system access.

Detection Guidance

Check authentik version with 'authentik version' or via API. Inspect logs for unauthorized access attempts to Remote Access Control endpoints. Review network traffic for unusual connections to RDP, SSH, or VNC endpoints from non-authorized users.

Impact Analysis

An attacker could steal stored credentials for managed systems and gain interactive access to unauthorized targets. This could lead to data breaches, system compromise, or lateral movement within a network if credentials are reused.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data (credentials) and allowing unauthorized access to systems, potentially leading to data breaches. Organizations may face penalties under GDPR, HIPAA, or other regulations for failing to protect access controls.

Mitigation Strategies

Upgrade authentik to version 2026.2.6 or 2026.5.5 or later immediately. Rotate all stored credentials for RDP, SSH, and VNC endpoints. Verify application permissions and restrict access to Remote Access Control endpoints.

Hi! I’m here to help you understand CVE-2026-61574. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70