CVE-2026-61574 goauthentik CVE debrief

Who should care

Deployments using the enterprise Remote Access Control provider of authentik should assess exposure and verify inventory, as stored credentials for managed RDP, SSH, and VNC targets may be at risk.

Why it matters

CVE-2026-61574 is a high-severity vulnerability in authentik's Remote Access Control endpoint listing. Any authenticated user can read every endpoint along with its host and stored credentials, and open a connection to an endpoint belonging to another application. This issue requires immediate attention from deployments using the enterprise Remote Access Control provider.

• Verify and update stored credentials for managed RDP, SSH, and VNC targets
• Restrict access to Remote Access Control endpoints
• Review and update authentik to version 2026.2.6 or 2026.5.5

Technical summary

The authentik Remote Access Control endpoint listing vulnerability allows any authenticated user to read every endpoint along with its host and stored credentials, and open a connection to an endpoint belonging to another application. This issue is fixed in versions 2026.2.6 and 2026.5.5, and deployments using the enterprise Remote Access Control provider should assess exposure and verify inventory, as stored credentials for managed RDP, SSH, and VNC targets may be at risk. The endpoint listing does not apply the access controls governing the endpoints, and the connection flow does not confirm that an endpoint belongs to the Remote Access Control application through which it was launched.

Defensive priority

High

Recommended defensive actions

• Review and update authentik to version 2026.2.6 or 2026.5.5
• Restrict access to Remote Access Control endpoints
• Verify and update stored credentials for managed RDP, SSH, and VNC targets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the authentik Remote Access Control endpoint listing vulnerability. The issue allows any authenticated user to read every endpoint along with its host and stored credentials, and open a connection to an endpoint belonging to another application.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.