Remote Access Control Vulnerability in Authentik Identity Provider

CVE-2026-61574

What is CVE-2026-61574?

Authentik, an open-source identity provider, has a vulnerability in the Remote Access Control endpoint that allows any authenticated user to view all configured endpoints and their associated connection settings, which may include sensitive stored credentials. This issue occurs because the endpoint does not enforce proper access controls, enabling users to access endpoints belonging to different applications. As a result, this flaw can lead to unauthorized access to managed RDP, SSH, and VNC targets, allowing attackers to interact with systems they should not access. The vulnerability has been addressed in versions 2026.2.6 and 2026.5.5.

References