See https://docs.goauthentik.io/docs/releases/2026.2#fixed-in-202627
What's Changed
- lifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.2) by @authentik-cherry-pick[bot] in #24113
- policies: filter policy engine (cherry-pick #24025 to version-2026.2) by @authentik-cherry-pick[bot] in #24169
- ci: add working dir prefix to file paths (cherry-pick #24319 to version-2026.2) by @authentik-cherry-pick[bot] in #24321
- providers/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.2) by @authentik-cherry-pick[bot] in #24443
- core: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.2) by @authentik-cherry-pick[bot] in #24817
- rbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.2) by @authentik-cherry-pick[bot] in #24946
- core: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.2) by @authentik-cherry-pick[bot] in #24956
- server/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.2) by @authentik-cherry-pick[bot] in #25363
- stages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.2) by @authentik-cherry-pick[bot] in #25499
- lib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.2) by @authentik-cherry-pick[bot] in #25759
- ci: bump golangci lint (cherry-pick #25513 to version-2026.2) by @authentik-cherry-pick[bot] in #25975
- security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #25956
- security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #25958
- security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #25957
- security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #25955
- security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2 by @authentik-automation[bot] in #25959
Full Changelog: version/2026.2.6...version/2026.2.7