CVE-2026-55106 goauthentik CVE debrief

Who should care

Defenders managing authentik instances with LDAP Source configurations should assess exposure and prioritize upgrading to fixed versions. This includes reviewing LDAP Source API usage, verifying current authentik versions, and restricting access if possible. Security teams and vulnerability management teams should also review the potential impact and plan for mitigations.

Why it matters

CVE-2026-55106 is a medium-severity vulnerability in authentik's LDAP Source API diagnostic action, allowing potential exposure of directory structure and account information. Defenders managing authentik instances with LDAP Source configurations should assess exposure and prioritize upgrading to fixed versions.

• Potential exposure of directory structure and account information
• Verification of LDAP Source API usage and access controls is necessary
• Upgrade to fixed versions to prevent unauthorized information disclosure

Technical summary

The diagnostic action on the LDAP Source API in authentik versions prior to 2026.2.6 and 2026.5.5 does not enforce object-level read-authorization, allowing unauthenticated clients to invoke the action and potentially expose directory structure and account information. This issue allows the server to connect to the upstream directory using the source's configured bind credentials and return a bounded set of directory entries, exposing distinguished names and attribute names but not attribute values. Deployments without a configured LDAP Source are not affected.

Defensive priority

Defenders should prioritize verifying and upgrading to versions 2026.2.6 or 2026.5.5 if using authentik with an LDAP Source configuration.

Recommended defensive actions

• Verify if using authentik with an LDAP Source configuration
• Check current authentik version and upgrade to 2026.2.6 or 2026.5.5 if necessary
• Review LDAP Source API usage and restrict access if possible
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source references indicate that authentik versions prior to 2026.2.6 and 2026.5.5 have a diagnostic action on the LDAP Source API that does not enforce object-level read-authorization, potentially exposing directory structure and account information. The server connects to the upstream directory using the source's configured bind credentials and returns a bounded set of directory entries. The response exposes the distinguished names of those entries and the names of the attributes present on them, but not attribute

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.