CVE-2026-94609

CVE-2026-94609 — authentik Privilege Escalation via Delegated Group/User Management -important Write-up and proof-of-concept for a privilege-escalation vulnerability in goauthentik/authentik, fixed in 2026.2.7 / 2026.5.7 / 2026.8.2 and assigned CVE-2026-94609 GHSA-h6c5-mpvq-j4jc. I was one of the...

authentik

What is authentik? authentik is an open-source Identity Provider IdP for modern SSO. It supports SAML, OAuth2/OIDC, LDAP, RADIUS, and more, designed for self-hosting from small labs to large production clusters. Our enterprise offering is available for organizations to securely replace existing...

GHSA-54P9-H82J-F925 vulnerabilities

Vulnerabilities for packages: authentik-fips, wazuh-manager, crossplane-function-pythonic, wazuh-manager-fips, py3-cassandra-medusa, nemo-rl-cuda-13.0, litellm, puppygraph-python, request-1276, authentik, mlflow-fips, airflow...

CVE-2026-104874 vulnerabilities

Vulnerabilities for packages: authentik-fips, wazuh-manager, crossplane-function-pythonic, wazuh-manager-fips, py3-cassandra-medusa, nemo-rl-cuda-13.0, litellm, puppygraph-python, request-1276, authentik, mlflow-fips, airflow...

CVE-2026-77387 vulnerabilities

Vulnerabilities for packages: authentik-fips, superset, superset-fips, authentik...

GHSA-MHVH-FQ92-PFMR vulnerabilities

Vulnerabilities for packages: authentik-fips, superset, superset-fips, authentik...

CVE-2026-15307 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, authentik...

GHSA-Q238-5CXM-5C9H vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, authentik...

GHSA-WVQV-FJ8W-QMHM vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, authentik...

CVE-2026-15830 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, authentik...

CVE-2026-102270 vulnerabilities

Vulnerabilities for packages: authentik-fips, superset-fips, nemo-rl-cuda-13.0, datadog-agent, kserve-huggingfaceserver-cuda-13.3, datadog-agent-fips...

GHSA-GVP8-978C-RX2Q vulnerabilities

Vulnerabilities for packages: authentik-fips, superset-fips, nemo-rl-cuda-13.0, datadog-agent, kserve-huggingfaceserver-cuda-13.3, datadog-agent-fips...

CVE-2026-103001 vulnerabilities

Vulnerabilities for packages: authentik-fips, superset-fips, nemo-rl-cuda-13.0, datadog-agent, kserve-huggingfaceserver-cuda-13.3, datadog-agent-fips...

GHSA-JWRC-G2Q2-PQ5P vulnerabilities

Vulnerabilities for packages: authentik-fips, superset-fips, nemo-rl-cuda-13.0, datadog-agent, kserve-huggingfaceserver-cuda-13.3, datadog-agent-fips...

CVE-2026-101918 vulnerabilities

Vulnerabilities for packages: authentik-fips, open-webui, superset-fips, nemo-rl-cuda-13.0, openstack-barbican-2026.1, kserve, openstack-nova-2026.1, openstack-placement-2025.2, semgrep, airflow-core, openstack-horizon-2025.2-fips, openstack-horizon-2026.1-fips, datadog-agent-fips,...

GHSA-42VR-XJ54-VC7V vulnerabilities

Vulnerabilities for packages: authentik-fips, open-webui, superset-fips, nemo-rl-cuda-13.0, openstack-barbican-2026.1, kserve, openstack-nova-2026.1, openstack-placement-2025.2, semgrep, airflow-core, openstack-horizon-2025.2-fips, openstack-horizon-2026.1-fips, datadog-agent-fips,...

BIT-AUTHENTIK-2026-94613 authentik: Denial of Service via Document Type Declarations in SAML Messages

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

BIT-AUTHENTIK-2026-94612 authentik: Authentication bypass via assertion confusion in SAML sources

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that...

BIT-AUTHENTIK-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

BIT-AUTHENTIK-2026-94609 authentik: Privilege Escalation to Superuser via Group Hierarchy

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...