Secuno
ENNL
Book demo

CVE-2026-94611

Information disclosure

8.1 HIGHEPSS 0.33%
  1. Published24 Sept 2026

Description

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets. Affected configurations include one-time code delivery by mail or SMS, outbound provisioning targets, device trust integrations, identity sources, the Kubernetes outpost integration, applications using a client or shared secret, and applications using a proxy provider. Deployments are affected when view permission is granted to accounts that are not intended to read these credentials; deployments where every viewer is permitted to read them are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

and 5 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-938928.1
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated…
CVE-2026-821039.6
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker…
CVE-2026-1078118.8
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0,…
CVE-2026-394608.1
Usernames and passwords, including the default factory credentials, are stored in…
CVE-2026-839438.7
Exposure of sensitive information to an unauthorized actor in Azure API Center allows…
CVE-2026-764839.1
As part of Cisco's ongoing commitment to proactive security and product quality, the…

Frequently asked

Is CVE-2026-94611 being actively exploited?

CVE-2026-94611 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.33%.

How severe is CVE-2026-94611?

CVE-2026-94611 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 0.33% probability of exploitation.

How do I fix CVE-2026-94611?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-94611 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.