Authentik 2026.8: PAM, Scheduled Offboarding and the Rust Rewrite

Authentik 2026.8 was released on 18 August 2026, and it is the first large release in the new three-month cycle. There is a lot in it: privileged access management with requests and approvals, scheduled offboarding at a fixed point in time, a Rust rewrite of server and proxy outpost, connection pooling for PostgreSQL and several OAuth 2.0 extensions. Plus three breaking changes, one of which is easily missed in operation and then quietly undermines your policies. This article covers what is new, what requires Enterprise and what belongs on the checklist before upgrading.

Also of interest: Authentik security posture in summer 2026 · NIS2: MFA and access control with Authentik · Account lockdown in 2026.5

Table of Contents

• The release at a glance
• Privileged access management: the real addition
• Scheduled offboarding
• The Rust rewrite
• Three breaking changes, one of them insidious
• What else is in it
• Upgrade order
• What this means for authhost customers
• Conclusion
• Sources

The release at a glance

The tag version/2026.8.0 was published on 18 August 2026 [2]. It is the first release after the move to a three-month cycle [4], which we described in the summer 2026 security posture, and the volume of changes matches that rhythm.

The main points from the release notes [1]:

Privileged access management: the real addition

The biggest substantive addition is PAM. Users can request access to applications and entitlements; designated approvers can approve or deny and set when the access expires [1].

Why this is more than convenience: the usual way to handle elevated access is permanent group membership. Somebody needs access to a system once, is added to the group and stays there because nobody has a reason to remove them. Two years later the group has thirty members, ten of whom never needed the access again.

Time-boxed, requested access inverts that: the default state is no access, the exception is logged and expires by itself. For access control under NIS2, which we covered in a dedicated article, this is the most practically relevant building block in a long while.

The catch: PAM is labelled Enterprise in the release notes [3]. Anyone running the Community Edition does not get it. That belongs before the planning, not after.

Scheduled offboarding

The second addition is unspectacular and probably more useful day to day. Administrators can schedule a user for deactivation or deletion at a specific date and time, optionally revoking sessions and tokens. Scheduled offboardings can be reviewed and cancelled before they run [1].

The use case is obvious once you have seen it: fixed-term contracts, internships, external contractors with a project end. The end date is known when the account is created. Until now somebody had to keep it in a calendar and remember it on the last day. Now it is set at creation time.

This feature carries no Enterprise label in the release notes.

The Rust rewrite

The authentik server, the entry point for requests, and the proxy outpost were previously written in Go and are now implemented in Rust; the project describes the implementation as a one-to-one match with the previous code [1].

For operators this is invisible at first. It is a foundational change, not a feature gain, and the release notes contain no promised improvement in throughput or memory that one could quote.

It still belongs on the test plan, for a simple reason: this component sits where every request passes through. A rewrite described as one-to-one is a careful claim, but it does not replace a trial run with your own configuration. Anyone running custom headers, unusual proxy chains or exotic outpost setups should rehearse this before going live.

Three breaking changes, one of them insidious

The release notes name three changes with breaking potential [1].

1. hash_password no longer takes a positional argument. The management command no longer accepts the password as a command-line argument. Anyone using this in a script has to adapt. The reason is sound anyway: passwords on the command line end up in shell history and in the process list.

2. "Prevent duplicate devices" is gone. The option in the WebAuthn authenticator setup stage was removed. The justification is notably candid: it compared attestation certificates that manufacturers deliberately share across entire production batches [1]. The feature could therefore never reliably do what its name promised. Anyone relying on it was relying on something that did not work.

3. Forwarded headers only from trusted proxies. This is the one that causes trouble in operation. authentik only uses forwarded request headers when the connection comes from a trusted proxy network [1]. Before upgrading, verify that the reverse proxy sends the required headers and that every address and network from which it connects directly to authentik is listed in AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS [1].

If this is missed, the fault does not announce itself. authentik keeps running but sees the proxy's IP rather than the client's. Geo policies, IP allow lists and anomaly detection then rate every request identically because they all appear to come from the same network. That is a quiet degradation of your security posture, not an outage.

What else is in it

Briefly, but worth noting [1]:

• Object attributes: custom text, number and boolean fields for users, groups and other objects, with validation.
• Nested LDAP groups: LDAP sources can preserve the source directory's group hierarchy instead of flattening it. Anyone synchronising from Active Directory knows the problem.
• OAuth 2.0 extensions: token exchange, on-behalf-of delegation, dynamic client registration and key binding for ID tokens.
• Self-hosted event map: the events map now uses a basemap bundled with authentik and makes no external requests by default. A small but clean privacy gain: until now every map view in the admin area left your installation.
• Connection pooling: support for a transaction-mode PostgreSQL pooler alongside a separate direct connection for operations requiring a stable session.

Upgrade order

1. Read the release notes, in particular the breaking changes section [1].
2. Set AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS before upgrading, not after.
3. Check scripts that call hash_password with a positional argument.
4. Test on a copy, with particular attention to proxy chains, outposts and custom headers. The Rust rewrite touches exactly that path.
5. Verify that geo- or IP-based policies still see the client IP after the upgrade. A glance at the events is enough.
6. Only then go live.

What this means for authhost customers

We run Authentik as a dedicated instance and perform version changes with notice and a maintenance window. For 2026.8 that means concretely: the trusted proxy configuration is part of our upgrade, not your homework, and the Rust rewrite is exercised on a copy first.

The price comes from instance size and support tier. In the Germany region size S costs EUR 99.90 net per month with 2 vCPU, 4 GB RAM and 80 GB NVMe, M costs EUR 149.90 and L EUR 249.90. The Business support tier adds EUR 100, Priority EUR 150 and Enterprise EUR 350. The instance is dedicated and users are not billed by count.

Honesty requires one addition: PAM and agent accounts are Enterprise features of authentik itself [3]. Managed hosting does not change that; it is a licensing question between you and Authentik Security. What we will do is tell you beforehand what your edition includes, instead of letting you find out after the upgrade.

The trial runs 7 days. A credit card is required to sign up, and after it expires the trial converts automatically into the chosen paid subscription.

See pricing · See managed Authentik

Conclusion

2026.8 is a release worth having. PAM closes a real gap in access control, scheduled offboarding removes one of the most reliable failure points in the user lifecycle, and the self-hosted event map is a small but correct step.

Two things belong in the picture. PAM and agent accounts are Enterprise, which for many installations decides whether the release delivers what makes it interesting at all. And the trusted proxy change is exactly the kind of breaking change that does not fail loudly but quietly removes the effect of your policies. Set it before the upgrade and you get a quiet maintenance window.

authhost is an independent managed hosting provider and is not affiliated with Authentik Security, Inc. "authentik" is a trademark of its respective holders. Statements about editions and feature scope follow the official documentation and can change with new versions; the project's documentation is authoritative. This article does not constitute legal advice.

Sources

• [[1]] authentik release notes 2026.8 – PAM, agent accounts, scheduled offboarding, account switching, object attributes, nested LDAP groups, Rust rewrite, connection pooling, breaking changes
• [[2]] goauthentik/authentik · release version/2026.8.0 on GitHub (published 18 Aug 2026)
• [[3]] authentik release notes 2026.8 – Enterprise labelling of privileged access management and agent accounts
• [[4]] authentik documentation – releases overview
• authhost.de – managed Authentik hosting