CVE-2026-61574
authentik RAC: access any endpoint via an unrelated application
Description
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain stored credentials. The endpoint listing does not apply the access controls governing the endpoints, and the connection flow does not confirm that an endpoint belongs to the Remote Access Control application through which it was launched. Any authenticated user can therefore read every endpoint together with its host and stored credentials and can open a connection to an endpoint belonging to another application. This exposes stored credentials for managed RDP, SSH, and VNC targets and grants interactive access to systems the user was never authorized to reach. Deployments that do not use the enterprise Remote Access Control provider are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.
INFO
Published Date :
Aug. 18, 2026, 5:16 p.m.
Last Modified :
Oct. 22, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update authentik to version 2026.2.6 or later.
- Ensure Remote Access Control provider is configured.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-61574.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-61574 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-61574
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-61574 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-61574 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 22, 2026
Action Type Old Value New Value Added Translation Title: authentik de goauthentik, Description: authentik es un proveedor de identidad de código abierto. Antes de 2026.2.6 y 2026.5.5, la lista de puntos finales de Control de Acceso Remoto devuelve cada punto final configurado a cualquier usuario autenticado, independientemente de las aplicaciones a las que el usuario pueda acceder, y la respuesta incluye configuraciones de conexión que pueden contener credenciales almacenadas. La lista de puntos finales no aplica los controles de acceso que rigen los puntos finales, y el flujo de conexión no confirma que un punto final pertenece a la aplicación de Control de Acceso Remoto a través de la cual fue lanzado. Cualquier usuario autenticado puede, por lo tanto, leer cada punto final junto con su host y credenciales almacenadas y puede abrir una conexión a un punto final perteneciente a otra aplicación. Esto expone credenciales almacenadas para objetivos RDP, SSH y VNC gestionados y otorga acceso interactivo a sistemas a los que el usuario nunca fue autorizado a acceder. Las implementaciones que no utilizan el proveedor de Control de Acceso Remoto empresarial no se ven afectadas. Este problema está solucionado en las versiones 2026.2.6 y 2026.5.5. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 19, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-61574', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-19T15:03:57.399755Z'} -
New CVE Received by [email protected]
Aug. 18, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'goauthentik', 'product': 'authentik', 'versions': [{'status': 'affected', 'version': '< 2026.2.6'}, {'status': 'affected', 'version': '>= 2026.5.0, < 2026.5.5'}]}] Added Description authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain stored credentials. The endpoint listing does not apply the access controls governing the endpoints, and the connection flow does not confirm that an endpoint belongs to the Remote Access Control application through which it was launched. Any authenticated user can therefore read every endpoint together with its host and stored credentials and can open a connection to an endpoint belonging to another application. This exposes stored credentials for managed RDP, SSH, and VNC targets and grants interactive access to systems the user was never authorized to reach. Deployments that do not use the enterprise Remote Access Control provider are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-639 Added CWE CWE-863 Added Reference https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6 Added Reference https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5 Added Reference https://github.com/goauthentik/authentik/security/advisories/GHSA-rv9x-92g6-9cpf