Will CVE in v2025.4.1 be fixed in v2025.6.0?

[woonboontok]

Hi,

Found 2 CVE (Common Vulnerabilities and Exposures) in v2025.4.1:

1. CVE-2025-4598 (Medium) - systemd
2. CVE-2023-4641 (Medium) - shadow

May I know if there is a fixed version or will it get fixed in v2025.6.0?

Thank you.

[rissson]

authentik is not affected by either of those

[woonboontok]

Noted, it does not affect the functionality of authentik. However, it is flagged out as unsafe because the image contains these vulnerabilities in the results the security scan.

[rwjack]

2025.2 (aka latest) is riddled with vulns: Vulnerabilities: CRITICAL: 3, HIGH: 20, MEDIUM: 65, LOW: 83, INFORMATIONAL: 7

Which brings me to my initial question, can we get the latest server image actually tagged as latest, instead of it being 2025.2?

[rissson]

No. See https://docs.goauthentik.io/docs/releases/2025.4#breaking-changes

[rwjack]

I don't see the logic behind that, but it's not my project.

Thanks for clarifying.