CVE-2026-25227: RCE in authentik Identity Provider

The impact of this vulnerability is severe. An attacker who possesses the 'Can view * Property Mapping' or 'Can view Expression Policy' permission can leverage the test endpoint to execute arbitrary code on the authentik server. This could lead to complete system compromise, including data exfiltration, privilege escalation, and denial of service. The ability to execute arbitrary code within the container environment significantly expands the attack surface and potential damage. This vulnerability shares similarities with other privilege escalation exploits where seemingly benign permissions are abused to gain higher-level access.

1. Reserved2026-01-30
2. Published2026-02-12
3. Modified2026-02-17
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade authentik to version 2025.12.4 or later. If upgrading is not immediately feasible, consider restricting access to the test endpoint or revoking 'Can view * Property Mapping' and 'Can view Expression Policy' permissions from users who do not absolutely require them. Implement strict network segmentation to limit the potential blast radius in case of compromise. Monitor authentik logs for suspicious activity, particularly requests to the test endpoint from unauthorized users. After upgrading, confirm the fix by attempting to access the test endpoint with a user possessing the affected permissions and verifying that code execution is prevented.