Skip to content
QuenchWorks

authentik 0.1.47

Chart · Secrets & identity · standard · v0.1.47

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64

Self-hosted identity provider (OIDC, SAML, LDAP, SCIM) with flows, policies, and application/provider management. Built clean-room from source on Wolfi as a four-language image (nodejs web UI, Go server/proxy, Rust worker, Python/Django core via uv) on a hardened nonroot base; FIPS mode is not forced and the license-gated MaxMind GeoIP download is omitted. Needs PostgreSQL and Redis at runtime, provided by the chart.

Version

0.1.48 · latest0.1.470.1.46

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version. Only the most recent releases are listed — an older chart pins an older image digest.

Released version

This is the 0.1.47 release of the authentik chart, published 2026-10-22. For the live security report and the currently deployed image digest, see the latest release.

Signed
cosign keyless
SBOM
SPDX, on image
Provenance
SLSA build
Architectures
amd64, arm64
Runs as
nonroot (uid 1001)
Root filesystem
read-only

Security report (Trivy)

D· 0/10024 fixable · rebuild clears them

Vulnerability detail

authentik 2026.8.5 · 24 CVE
CVESeverityPackageInstalledFixed inTitle
CVE-2026-111943HIGHpy3-pip-wheel26.2.2-r026.2.2-r2crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
CVE-2026-114136HIGHdjangorestframework3.17.23.18.2djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser
CVE-2026-114137HIGHdjangorestframework3.17.23.18.2djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy
CVE-2026-114138HIGHdjangorestframework3.17.23.18.2djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing
CVE-2026-114605HIGHdnspython2.8.02.9.0dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal
CVE-2026-114613HIGHpy3-pip-wheel26.2.2-r026.2.2-r1msgpack: msgpack: Denial of Service via memory leak during map deserialization
CVE-2026-114613HIGHmsgpack1.2.11.2.3msgpack: msgpack: Denial of Service via memory leak during map deserialization
CVE-2026-116587HIGHgithub.com/go-jose/go-jose/v4v4.1.44.1.6github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs
CVE-2026-119194HIGHpyasn10.6.40.6.5pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding
CVE-2026-119195HIGHpyasn10.6.40.6.5pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data
CVE-2026-119196HIGHpyasn10.6.40.6.5pyasn1: pyasn1: Denial of Service via constructed bit string decoding
CVE-2026-119197HIGHpyasn10.6.40.6.5pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding
CVE-2026-114583MEDIUMpython-3.143.14.8_git20261021-r13.14.10_git20261028-r0tarfile.tar_filter could be bypassed using crafted link entries, inclu ...
CVE-2026-114583MEDIUMpython-3.14-base3.14.8_git20261021-r13.14.10_git20261028-r0tarfile.tar_filter could be bypassed using crafted link entries, inclu ...
CVE-2026-114583MEDIUMpython-3.14-runtime3.14.8_git20261021-r13.14.10_git20261028-r0tarfile.tar_filter could be bypassed using crafted link entries, inclu ...
CVE-2026-114603MEDIUMopentelemetry-api1.43.01.45.1opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing
CVE-2026-115557MEDIUMpython-3.143.14.8_git20261021-r13.14.10_git20261028-r0Python has added a denylist for known compromised certificates to the ...
CVE-2026-115557MEDIUMpython-3.14-base3.14.8_git20261021-r13.14.10_git20261028-r0Python has added a denylist for known compromised certificates to the ...
CVE-2026-115557MEDIUMpython-3.14-runtime3.14.8_git20261021-r13.14.10_git20261028-r0Python has added a denylist for known compromised certificates to the ...
CVE-2026-116585MEDIUMgithub.com/go-jose/go-jose/v4v4.1.44.1.5github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption
CVE-2026-116586MEDIUMgithub.com/go-jose/go-jose/v4v4.1.44.1.5github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing
GHSA-xmj3-9gf7-h52wLOWsetuptools83.0.084.1.0setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
CVE-2026-78661UNKNOWNgolang.org/x/netv0.60.00.62.0When coalescing adjacent text nodes in addText and fosterParent, appen ...
CVE-2026-97045UNKNOWNgolang.org/x/netv0.60.00.62.0In childTextNodesAreLiteral, walking up the tree previously stopped at ...
0
Critical
12
High
9
Medium
1
Low
2
Unknown

Security report (Trivy) · image authentik 2026.8.5

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (pinned to 0.1.47)

helm install my-authentik oci://ghcr.io/quenchworks/charts/authentik --version 0.1.47
Chart version
0.1.47
Chart license
MIT
App license
MIT
Service port
80
Signed
cosign (keyless)
Released
2026-10-22

Verify the chart

cosign verify ghcr.io/quenchworks/charts/authentik:0.1.47 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View the imageView on ArtifactHubChart source

Upstream project: https://goauthentik.io