authentik 受 PropertyMapping 测试端点中的上下文键注入影响，可能导致远程代码执行

The impact of this vulnerability is severe. An attacker who possesses the 'Can view * Property Mapping' or 'Can view Expression Policy' permission can leverage the test endpoint to execute arbitrary code on the authentik server. This could lead to complete system compromise, including data exfiltration, privilege escalation, and denial of service. The ability to execute arbitrary code within the container environment significantly expands the attack surface and potential damage. This vulnerability shares similarities with other privilege escalation exploits where seemingly benign permissions are abused to gain higher-level access.

Organizations relying on authentik for identity management, particularly those with delegated permissions configured, are at risk. Shared hosting environments where multiple users have access to authentik instances are especially vulnerable, as a compromised user on one instance could potentially impact others. Legacy authentik deployments with outdated permission configurations are also at increased risk.

• linux / server:

journalctl -u authentik -g 'test endpoint'

• linux / server:

ps aux | grep authentik | grep 'test endpoint'

• generic web:

curl -I https://<authentik_server>/admin/property-mappings/test

• generic web:

curl -I https://<authentik_server>/admin/expression-policies/test

1. 2026-02-12Disclosure

   disclosure

2. 2026-02-12Patch

   patch

1. 已保留2026-01-30
2. 发布日期2026-02-12
3. 修改日期2026-02-17
4. EPSS 更新日期2026-03-23

The primary mitigation is to immediately upgrade authentik to version 2025.12.4 or later. If upgrading is not immediately feasible, consider restricting access to the test endpoint or revoking 'Can view * Property Mapping' and 'Can view Expression Policy' permissions from users who do not absolutely require them. Implement strict network segmentation to limit the potential blast radius in case of compromise. Monitor authentik logs for suspicious activity, particularly requests to the test endpoint from unauthorized users. After upgrading, confirm the fix by attempting to access the test endpoint with a user possessing the affected permissions and verifying that code execution is prevented.