CVE-2026-61574 is an authorization bypass vulnerability in the open-source identity provider authentik. The Remote Access Control endpoint list endpoint returns all configured endpoints and connection settings, including stored credentials, to any authenticated user without enforcing access controls. The connection flow does not verify that an endpoint belongs to the Remote Access Control application through which it was launched. Consequently, any authenticated user can read all endpoints and open connections to endpoints of other applications, exposing stored credentials for RDP, SSH, and VNC targets and granting unauthorized interactive access. This vulnerability affects authentik versions prior to 2026.2.6 and versions from 2026.5.0 up to but not including 2026.5.5. Deployments not using the enterprise Remote Access Control provider are not impacted. The vulnerability is addressed in versions 2026.2.6 and 2026.5.5.

The vulnerability allows any authenticated user to bypass authorization controls and access all configured Remote Access Control endpoints and their stored credentials. This exposure includes credentials for managed RDP, SSH, and VNC targets, enabling unauthorized interactive access to systems the user should not reach. This can lead to full compromise of affected systems and sensitive credential leakage. Deployments without the enterprise Remote Access Control provider are not affected.

Upgrade authentik to version 2026.2.6 or later, or to version 2026.5.5 or later, as these versions contain the official fix for this vulnerability. Deployments not using the enterprise Remote Access Control provider are not affected and require no action related to this issue.