CVE-2026-25227: 
NixOS vulnerability analysis and mitigation

CVE-2026-25227 is an authenticated remote code execution (RCE) vulnerability in authentik, an open-source identity provider. Affecting versions from 2021.3.1 through before 2025.8.6, 2025.10.0 through before 2025.10.4, and 2025.12.0 through before 2025.12.4, the flaw allows users with delegated "Can view * Property Mapping" or "Can view Expression Policy" permissions to execute arbitrary code within the authentik server container via the policy/property mapping test endpoint. It was disclosed on February 12, 2026, and reported by researcher @rahulgovind. The CVSS v3.1 base score is 9.1 (Critical) per the GitHub Security Advisory, though NVD records 7.2 (High) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The root cause lies in the wrap_expression method within authentik/lib/expression/evaluator.py, where context variable names (keys) were used unsanitized as Python function argument names in a dynamically constructed handler function. An attacker could craft a malicious context key — such as one containing Python import statements — that would be injected directly into the generated function signature, causing arbitrary code execution when the expression was evaluated. The fix applies slugify() in addition to the existing regex sanitization (sanitize_arg) to neutralize special characters in argument names before they are embedded in the generated code (GitHub Commit, GitHub Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary code within the authentik server container with full access to the authentik database and all environment variables, enabling privilege escalation and complete instance takeover. This can result in unauthorized modification of authentication configurations, exposure of credentials and secrets stored in environment variables, and disruption of authentication services for all applications relying on the identity provider. The scope of impact extends beyond the authentik container itself, as compromising the identity provider can facilitate lateral movement into any application or service that trusts authentik for authentication (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. Exploitation requires an authenticated user account with the delegated "Can view * Property Mapping" or "Can view Expression Policy" permissions, which limits the attack surface to users who have been granted these specific (but potentially over-provisioned) permissions. The EPSS score is approximately 0.033%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, GitHub Advisory).

1. Obtain credentials with target permissions: Acquire an authentik user account that has been granted the "Can view * Property Mapping" or "Can view Expression Policy" delegated permission — either through social engineering, credential theft, or by being a legitimate low-privilege user with these permissions.
2. Authenticate to the authentik API: Log in to the authentik instance and obtain a valid session token or API token for use in subsequent API calls.
3. Identify a target property mapping or expression policy UUID: Browse the authentik admin interface or query GET /api/v3/propertymappings/all/ or GET /api/v3/policies/all/ to enumerate available mappings/policies and retrieve a valid UUID.
4. Craft a malicious payload: Construct a POST request to the test endpoint (POST /api/v3/propertymappings/all/<uuid>/test/ or POST /api/v3/policies/all/<uuid>/test/) with a context key containing an injected Python expression, such as: {"context": {"z=getattr(getattr(__import__(\"os\"), \"popen\")(\"id > /tmp/pwned\"), \"read\")()": "value"}}. The malicious key is embedded unsanitized into the generated Python function signature.
5. Trigger code execution: Submit the crafted request; the server evaluates the dynamically constructed function, executing the injected OS command within the authentik server container.
6. Escalate and persist: Use the code execution to read environment variables (e.g., database credentials, secret keys), modify authentication configurations, create backdoor admin accounts, or establish persistence within the container (GitHub Commit, GitHub Advisory).

• Network: Unexpected POST requests to /api/v3/propertymappings/all/<uuid>/test/ or /api/v3/policies/all/<uuid>/test/ from accounts that do not normally use these endpoints; unusual outbound connections from the authentik server container to external IPs.
• Logs: authentik API access logs showing test endpoint calls from non-administrative user accounts; Python evaluation errors or unexpected output in authentik server logs related to expression evaluation; log entries showing access to OS-level functions (os.popen, subprocess, __import__) within expression evaluation context.
• File System: Unexpected files created within the authentik container (e.g., /tmp/ artifacts from command execution); new or modified configuration files within the container.
• Process: Unusual child processes spawned by the authentik Python/Django process (e.g., sh, bash, curl, wget); unexpected network connections initiated by the authentik worker process.
• Database: New admin or superuser accounts created in the authentik database without corresponding administrative action; modified permission assignments for existing users (GitHub Advisory, GitHub Commit).

Upgrade to authentik versions 2025.8.6, 2025.10.4, or 2025.12.4 depending on your current release branch — these versions apply proper sanitization using slugify() to context variable names before code generation. If an immediate upgrade is not possible, remove the "Can view * Property Mapping" and "Can view Expression Policy" delegated permissions from any user that does not require full administrative access, treating these permissions as equivalent to their edit counterparts. As an additional network-level workaround, block POST requests to the test endpoints: POST /api/v3/propertymappings/all/<uuid>/test/ and POST /api/v3/policies/all/<uuid>/test/ (GitHub Advisory, Release 2025.8.6, Release 2025.10.4, Release 2025.12.4).

The vulnerability was discussed on Reddit's r/selfhosted community, where self-hosters noted the importance of updating to the patched releases (Reddit). Security-focused Mastodon and Bluesky accounts, including @offseq and The Hacker Wire, highlighted the RCE nature of the flaw shortly after disclosure (Infosec.exchange, Bluesky). The vulnerability was also covered by The Hacker Wire as a notable RCE via the property mapping test endpoint (The Hacker Wire).