authentik RAC Endpoint Credential Exposure and Access Control Bypass (CVE-2026-61574)

Vulnerability Overview Title: RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries Description: The Remote Access Control (RAC) endpoint list returns all configured endpoints to any authenticated user, regardless of whether those endpoints are accessible. The response includes connection settings that may contain stored credentials. Any authenticated user can launch a RAC application and connect to endpoints that do not belong to that application. Impact Affected Versions: - <= 2026.5.4 - <= 2026.2.5 Impact: - Deployments using enterprise Remote Access Control (RAC) providers are affected. - Endpoint enumeration impacts every deployment; credential exposure impacts every deployment that stores RAC endpoint credentials. - Deployments that do not use Remote Access Control are not affected. - The endpoint list does not enforce access controls inherent to the endpoints themselves, and the connection flow does not verify that the opened endpoint belongs to the initiating application. - Any authenticated user can read all endpoints, their hosts, and stored credentials, and access endpoints outside the context of the application. - Stored credentials for managed RDP, SSH, and VNC targets are exposed, granting users unauthorized interactive access to systems. Remediation Fixed Versions: - 2026.5.5 - 2026.2.6 Workarounds: - Prior to upgrading, do not rely on Remote Access Control endpoint access rules. - After upgrading, rotate the stored RAC endpoint credentials. Additional Information CVE ID: CVE-2026-61574 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High Weaknesses: - CWE-639 - CWE-863 Contributors: - szbynev - Sulph3r - blckssk11 - XindITeam - arthurschan - DavidKorczynski - AdamKorcz - keenanmago - liangjs - ATun More Information: - For any questions or comments, please email security@goauthentik.io.

Goal Reached Thanks to every supporter — we hit 100%!

authentik RAC Endpoint Credential Exposure and Access Control Bypass (CVE-2026-61574)

More from this source