authentik 2026.5.6 → 2026.8.4
7 releases · 1 breaking change · 6 security fixes · 5 advisories fixed
6security1breaking1deprecated22feature51fix
Vulnerabilities fixed by this upgrade
- 7.5 CVE-2026-94613 Denial of Service via Malformed SAML Messages
- 8.1 CVE-2026-94611 Certain stored credentials readable with view permission alone
- 7.4 CVE-2026-94612 Authentication bypass in SAML Sources via assertion confusion and replay
- 8.8 CVE-2026-94609 Privilege escalation via delegated group and user management
- 8.9 CVE-2026-94606 MFA bypass via recipient override in the email authenticator
Breaking changes
- breaking web/user: remove slug display in any display mode on the user application library page (#26441) in 2026.8.4
Security changes
- security root: document CNA in SECURITY.md (#26124) in 2026.8.3
- security security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5 in 2026.5.7
- security security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5 in 2026.5.7
Deprecations
- deprecated website/docs: mark deprecated PostgreSQL options and fix listen settings (cherry-pick #25074 to version-2026.8) in 2026.8.0
Every release in between
fixcommon/saml: Fix metadata to serve only the leaf of a PEM chain (#26273)
othercore: handle overflow in duration validation (#26680)
fixendpoints: fix error during device lookup with one identifier missing (#26902)
otherendpoints: retain last fact snapshot (#26343)
otherenterprise/requests: show message after successful request (#26587)
fixevents: fix group membership changes with OSS audit middleware (#26477)
featureflows: allow unauthenticated flows for re-authentication (#26785)
fixlifecycle: fix AWS cloudformation template defaults (#26807)
otheroutposts/proxy: don't negotiate HTTP/2 to upstreams (#26281)
otheroutposts/proxy: fetch embedded JWKS over the unix socket, not the browser host (#26448)
otheroutposts/proxy: use HTTP/1.1 for OAuth backchannel requests (#26422)
otherpackages/ak-axum/extract/client_ip: use the leftmost X-Forwarded-For IP (#26353)
fixpackages/ak-common/config: fix list values from env variables parsing (#26081)
otherpackages/django-channels-postgres: refresh pool credentials on connection attempts (#26505)
fixproviders/proxy: fix startup reconcile not being atomic (#26344)
otherproviders/scim: accept a service provider that reports bulk as unsupported (#25057)
fixproviders/scim: fix scim user conflict resolution (#25998)
otherproviders/scim: show remote error details for 4xx/5xx responses (#26906)
otherroot, web, docs: revert pnpm to 11.20.0 on version-2026.8 (#26366)
otherroot: don't fail websocket connections with non-UTF-8 headers (#26688)
fixroot: fix client certificate header forwarded to the mTLS stage (#26438)
otherroot: log full stacktrace for ASGI exception (#26415)
othersources/kerberos, sources/ldap: Save source connections when linking an existing user/group (#26059)
othersources/saml: Fallback NameID (#25713)
fixstages/consent: fix integrity error when re-consenting after consent expired (#26866)
otherweb: Close command palette when opening About (#25734)
fixweb: Fix denied template static form layout. (#26733)
fixweb: Fix disabled token icon buttons. (#25527)
otherweb: resolve themed icon URLs everywhere (#25103)
fixweb/admin: fix device view page and outpost view page (#26383)
otherweb/admin: restore file upload capability check (#26556)
otherweb/admin: show agent connector local auth & compliance status (#26610)
otherweb/admin: update oauth federated provider helptext wording (#26611)
otherweb/elements: reload edit forms after cancel and on pk change (#26892)
otherweb/flows: check if localStorage is available for continuous login (#26267)
fixweb/flows: fix layout shift once initial challenge is loaded (#26758)
fixweb/user: fix requests banner wording (#26586)
breakingweb/user: remove slug display in any display mode on the user application library page (#26441)
otheradmin/files: make file search case-insensitive (#25736)
otherapi: include JSON field relation models in search autocomplete (#26153)
fixblueprints: fix employee_department typo (#26046)
otherchange docker compose to compose (#26087)
fixcore: fix migrations (version-2026.8) (cherry-pick #26208) (#26209)
otherevents: Note in logs when an agent makes a call (#26146)
otherflows: strip login_hint from next on cancel to prevent loop (#26111)
otheroutposts: refresh sessions when impersonation changes (#26086)
otherpackages/ak-axum/extract/client_ip: support X-Forwarded-For with ports (#25682)
fixpolicies: fix policybinding cache invalidation (#25989)
fixproviders/ldap: fix memory leak in the cached searcher (#26028)
otherproviders/oauth: handle token exchange when no signing key is set (#26049)
otherproviders/oauth2: only expose URL-based avatars as picture claim (#26080)
securityroot: document CNA in SECURITY.md (#26124)
fixroot: fix metric gauges for multiprocessor mode (#25882)
otherserver: preserve websocket close code when proxying to outposts (#26090)
othersources/saml: Register ID attributes (#25706)
fixweb/flows: fix hardcoded locale in identification stage's OR_LIST_FORMATTERS (#26017)
featureweb/scim: Add gitlab compatibility option to form (#26154)
otherblueprints: emit draft-07 definitions instead of $defs (cherry-pick #24981 to version-2026.8)
featurewebsite/docs: add object attributes doc (cherry-pick #24437 to version-2026.8)
fixproviders/oauth2: fix dcr missing csrf_exempt (cherry-pick #24983 to version-2026.8)
fixweb/admin: fix missing preview banner for object attributes (cherry-pick #24982 to version-2026.8)
otherenterprise/requests: optimize db for requestable apps (cherry-pick #24984 to version-2026.8)
otherenterprise/endpoints/connectors/fleet: decrease page size (cherry-pick #24995 to version-2026.8)
fixweb/elements: fix prioritization in form serialization for dotted input-fields (cherry-pick #24987 to version-2026.8)
othertasks: aggregate status from logs instead of legacy field (cherry-pick #24792 to version-2026.8)
otherenterprise/stages/source: configurable failure action (cherry-pick #24963 to version-2026.8)
otherendpoints: handle error in facts (cherry-pick #25028 to version-2026.8)
featuresources/saml: add audience override field for SAML sources (cherry-pick #25029 to version-2026.8)
fixweb: Fix content_left/right layouts. (cherry-pick #25025 to version-2026.8)
featurewebsite/docs: add 2026.8 release note for task status change (cherry-pick #25044 to version-2026.8)
otheroutposts/proxy: include query string in post-authentication redirect (cherry-pick #25043 to version-2026.8)
otherwebsite/docs: preserve host and port in proxy provider nginx redirects (cherry-pick #24991 to version-2026.8)
othercore: bump goauthentik/fips-python from 3.14.6-slim-trixie-fips to 3.14.7-slim-trixie-fips in /lifecycle/container (cherry-pick #25049 to version-2026.8)
fixweb: Fix mangled nested CSS in compatibility mode. (cherry-pick #25053 to version-2026.8)
otherci: require test-rust to pass (cherry-pick #25066 to version-2026.8)
fixproviders/scim: fix group membership removals (cherry-pick #25024 to version-2026.8)
otherwebsite/docs: correct proxy unauthenticated path regex reference (cherry-pick #25077 to version-2026.8)
featurewebsite/docs: match UI label capitalization and add a style rule (cherry-pick #25080 to version-2026.8)
otherwebsite/docs: update source field labels renamed in 2026.8 (cherry-pick #25072 to version-2026.8)
otherpackages/django-dramatiq-postgres/broker: chunked purge queryset (cherry-pick #25102 to version-2026.8)
fixenterprise/requests: fix API schema for grant requests (cherry-pick #25111 to version-2026.8)
fixweb/user: fix request access URL from agent not working (cherry-pick #25113 to version-2026.8)
fixproviders/oauth2: fix token exchange provider lookup for actor/subject (cherry-pick #25110 to version-2026.8)
featureenterprise/endpoints/connectors/agent: add login_hint to auth_ia (cherry-pick #25122 to version-2026.8)
othercore: scope user path_startswith filter to the path subtree (cherry-pick #25093 to version-2026.8)
featurewebsite/docs: agents: add doc (cherry-pick #24826 to version-2026.8)
othersources/telegram: restore next= redirect after pre_authentication_flow (cherry-pick #22762 to version-2026.8)
othercore: delete all user sessions when user is deactivated (cherry-pick #25088 to version-2026.8)
deprecatedwebsite/docs: mark deprecated PostgreSQL options and fix listen settings (cherry-pick #25074 to version-2026.8)
otherweb: bump dompurify from 3.4.12 to 3.4.13 in /web (cherry-pick #24892 to version-2026.8)
featurewebsite/docs: add access requests doc (cherry-pick #24457 to version-2026.8)
otherproviders/oauth2: send back-channel logout requests when a user is deactivated (cherry-pick #24718 to version-2026.8)
othercore: bump h2 from 0.4.15 to 0.4.16 (cherry-pick #25183 to version-2026.8)
fixstages/email: fix test_email ignoring the given stage (cherry-pick #25166 to version-2026.8)
featureproviders/radius: allow empty message authenticator (cherry-pick #25097 to version-2026.8)
featurewebsite/docs: add OBO (cherry-pick #25149 to version-2026.8)
featurewebsite/docs: 2026.8 release notes: add features and links to docs (cherry-pick #25194 to version-2026.8)
+1 more item in the release notesotherci: remove the Google Chrome apt source in setup (cherry-pick #25990 to version-2026.5)
fixlib/expression: fix PickleError due to resolver match when using ak_call_policy (cherry-pick #25763 to version-2026.5)
fixweb/source/flows: fix flicker after webauthn (cherry-pick #25454 to version-2026.5)
othercore: bump rustls (cherry-pick #26142 to version-2026.5)
featurewebsite: add umami (cherry-pick #26460 to version-2026.5)
otherpackages/django-channels-postgres: refresh pool credentials on connection attempts (cherry-pick #26505 to version-2026.5)
otherweb/flows: check if localStorage is available for continuous login (cherry-pick #26267 to version-2026.5)
otherroot: don't fail websocket connections with non-UTF-8 headers (cherry-pick #26688 to version-2026.5)
fixstages/consent: fix integrity error when re-consenting after consent expired (cherry-pick #26866 to version-2026.5)
otherci: switch version bump to action, like platform repo (cherry-pick #26949 to version-2026.5)
otherroot: bump cert-related deps due to emudhra (cherry-pick #27068 to version-2026.5)
otherci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.5)
fixendpoints/connectors/agent: fix auth schema correctly (cherry-pick #24327 to version-2026.5)
fixenterprise/endpoints/connectors/fleet: fix exception when host has no policies (cherry-pick #24355 to version-2026.5)
fixbrands: fix schema for current brand's flags (cherry-pick #24376 to version-2026.5)
othercore: bump library/golang from 1.26.2-trixie to 1.26.5-trixie in /lifecycle/container
otherproviders/scim: ignore key casing in SCIM responses (cherry-pick #24441 to version-2026.5)
othercore: bump django from 5.2.15 to v5.2.16 (cherry-pick #24526 to version-2026.5)
fixfix pipeline for version 2026.5
otherendpoints/agent: return 400 instead of 500 for invalid Platform SSO token requests (cherry-pick #24588 to version-2026.5)
fixendpoints/agent: fix Secure Enclave key dropped on first Platform SSO user registration (cherry-pick #24587 to version-2026.5)
featurewebsite/docs: agent: Add API access scope requirement (cherry-pick #24567 to version-2026.5)
fixproviders/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.5)
otherwebsite/docs: correct authentik Agent CLI reference and macOS logging paths (cherry-pick #24605 to version-2026.5)
otherpackages/django-dramatiq-postgres: minor fixes (cherry-pick #23181 to version-2026.5)
fixcore: fix group source connection source object (cherry-pick #24626 to version-2026.5)
otherroot: don't include debug info for rust release profile (cherry-pick #24664 to version-2026.5)
featurewebsite/docs: welcome email notification rule: Add LDAP exception (cherry-pick #24672 to version-2026.5)
featurewebsite/docs: Add feedback from previous agent pr (cherry-pick #24713 to version-2026.5)
fixblueprints: fix mismatched stage name in example 2fa login flow (cherry-pick #24668 to version-2026.5)
featureblueprints: handle invalid yaml, add dry run to apply_blueprint (cherry-pick #24813 to version-2026.5)
fixproviders/oauth2: fix missing authorization event for oauth provider, add tests (cherry-pick #24819 to version-2026.5)
fixweb/flows: fix missing required flag on password input (cherry-pick #24831 to version-2026.5)
fixproviders/scim: fix display of SCIMRequestException (2026.8) (cherry-pick #24833 to version-2026.5)
fixstages/email: fix test_email ignoring the given stage (cherry-pick #25166 to version-2026.5)
featureproviders/radius: allow empty message authenticator (cherry-pick #25097 to version-2026.5)
fixendpoints/connectors: fix integrity error when device with same name exists already (cherry-pick #25237 to version-2026.5)
featurecore: add user type-active-username index (cherry-pick #25223 to version-2026.5)
featurecore: set days=1 as default token duration for new installs (cherry-pick #25341 to version-2026.5)
fixlib/expression: fix policy request context pollution (cherry-pick #25462 to version-2026.5)
fixworker: fix healthcheck paths (cherry-pick #24481 to version-2026.5)
fixtenants/settings: fix flags response (cherry-pick #25616 to version-2026.5)
fixweb/admin: fix schedule form (cherry-pick #25778 to version-2026.5)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5
fixlifecycle: fix server prometheus metrics getting registered early with pid instead of worker ID (cherry-pick #25883 to version-2026.5)
securitysecurity: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5
featurewebsite/docs: add release notes for 2026.2.7 (cherry-pick #25979 to version-2026.5)
featurewebsite/docs: add release notes for 2026.5.7 (cherry-pick #25980 to version-2026.5)
+21 more items in the release notes