version/2026.2.7
megadose/holeheversion/2026.2.7Sep 9, 2026by authentik-automation[bot]
Upgrading?
AI Summary
This patch release for version 2026.2 focuses on container lifecycle simplification by removing unnecessary utilities and backporting several security patches to address vulnerabilities in group hierarchy, email, SAML, and secrets.
Key Highlights
- Drops curl and runit from the lifecycle container
- Fixes SCIM changed detection for nested attributes
- Enables dynamic captcha keys when stage is embedded in identification
- Backports security patches for group hierarchy roles and email recipient override
- Backports security patches for SAML and secrets read permissions
Full Release Notes
See https://docs.goauthentik.io/docs/releases/2026.2#fixed-in-202627 ## What's Changed * lifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24113 * policies: filter policy engine (cherry-pick #24025 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24169 * ci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24321 * providers/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24443 * core: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24817 * rbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24946 * core: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24956 * server/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25363 * stages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25499 * lib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25759 * ci: bump golangci lint (cherry-pick #25513 to version-2026.2) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/25975 * security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25956 * security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25958 * security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25957 * security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25955 * security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/25959 **Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2026.2.6...version/2026.2.7
Related Repositories
public-apis/public-apis★ 491,135
A collective list of free APIs
NousResearch/hermes-agent★ 255,963
The agent that grows with you
yt-dlp/yt-dlp★ 200,054
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,491
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,703
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.