GHSA-8QCX-XF44-272X vulnerabilities

Vulnerabilities for packages: authentik-fips, openstack-horizon-2026.1-fips, authentik, openstack-horizon-2026.1...

GHSA-6HR6-W5QG-QMWG vulnerabilities

Vulnerabilities for packages: authentik-fips, jupyter-all-spark-notebook, prefect-fips, apache-beam-python-3.14-sdk, authentik, open-webui, mitmproxy, airflow, localstack...

CVE-2026-71554 vulnerabilities

Vulnerabilities for packages: authentik-fips, jupyter-all-spark-notebook, prefect-fips, apache-beam-python-3.14-sdk, authentik, open-webui, mitmproxy, airflow, localstack...

GHSA-5P4M-2WFM-XMQJ vulnerabilities

Vulnerabilities for packages: authentik-fips, unleash-fips, langfuse-fips, opensearch-dashboards, ts-patch, unleash, saf, prism, renovate, wazuh-dashboard, jitsucom-jitsu, redisinsight, lerna, arangodb, kibana, foxx-cli, sqlpad, code-server, langfuse, pulumi, vitess, wazuh-dashboard-fips,...

CVE-2026-69153 vulnerabilities

Vulnerabilities for packages: authentik-fips, renovate, kubeflow-pipelines, semaphore, authentik, pelias-api, langfuse, keep, langfuse-fips, saf, nextcloud-server, cadence-web, vitess, arangodb, keep-fips...

GHSA-FXQJ-RQCC-2CMP vulnerabilities

Vulnerabilities for packages: authentik-fips, renovate, kubeflow-pipelines, semaphore, authentik, pelias-api, langfuse, keep, langfuse-fips, saf, nextcloud-server, cadence-web, vitess, arangodb, keep-fips...

GHSA-RGW5-RVV9-X895 vulnerabilities

Vulnerabilities for packages: authentik-fips, opentelemetry-auto-instrumentations-node, langfuse-fips, nextcloud-server, npm, opensearch-dashboards, ts-patch, unleash, gemini-cli, gitlab-rails-ce-fips, saf, prism, renovate, wazuh-dashboard, redisinsight, pelias-api, rancher-api-ui, arangodb,...

CVE-2026-69152 vulnerabilities

Vulnerabilities for packages: authentik-fips, opentelemetry-auto-instrumentations-node, langfuse-fips, nextcloud-server, npm, opensearch-dashboards, ts-patch, unleash, gemini-cli, gitlab-rails-ce-fips, saf, prism, renovate, wazuh-dashboard, redisinsight, pelias-api, rancher-api-ui, arangodb,...

GHSA-6G55-P6WH-862Q vulnerabilities

Vulnerabilities for packages: authentik-fips, semaphore, authentik, pelias-api, langfuse, keep, langfuse-fips, nextcloud-server, cadence-web, vitess, arangodb, keep-fips...

GHSA-PM4M-PH32-GHV5 vulnerabilities

Vulnerabilities for packages: authentik-fips, kubeflow-pipelines, renovate...

GHSA-R28C-9Q8G-F849 vulnerabilities

Vulnerabilities for packages: authentik-fips, semaphore, authentik, jitsucom-jitsu, pelias-api, unleash-fips, langfuse, keep, langfuse-fips, nextcloud-server, cadence-web, librechat, unleash, vitess, arangodb, homepage, keep-fips...

CVE-2026-45623 vulnerabilities

Vulnerabilities for packages: authentik-fips, semaphore, authentik, pelias-api, langfuse, keep, langfuse-fips, nextcloud-server, cadence-web, vitess, arangodb, keep-fips...

CVE-2026-7666 vulnerabilities

Vulnerabilities for packages: authentik-fips, authentik...

GHSA-MM6V-Q8Q9-PGCF vulnerabilities

Vulnerabilities for packages: authentik-fips, authentik...

PT-2026-56531

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

PT-2026-56530

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage wit...

GHSA-6V7P-G79W-8964 vulnerabilities

Vulnerabilities for packages: authentik-fips, nvidia-nsight-compute-13.1, ansible-operator, dask-kubernetes, openstack-glance-2025.1, openstack-placement-2025.1-fips, openstack-tempest-2025.1, tensorflow-cpu-jupyter, openstack-glance-2025.1-fips, tritonserver-backend-vllm-cuda-12.9,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-secretsmanager, trivy, crossplane-provider-aws-osis-fips, hydra-fips, crossplane-provider-aws-route53resolver, spicedb-operator, zitadel, flux-kustomize-controller, cloud-provider-azure-fips, cloud-provider-azure, gitlab-operator, scorecard,...

CVE-2026-41569

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin...

CVE-2026-47201

authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed...