goauthentik / goauthentik/authentik
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS with single IPs without CIDR suffix prevents startup in 2026.8.0
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
### Describe the bug
After upgrading to **authentik 2026.8.0**, setting `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS` with a plain IP address causes authentik to fail during startup with a imprecise error:
```plain text
0: invalid IP address syntax
```
The error does not indicate that `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS` is the problematic setting.
This appears to be a breaking change because single IPv4 addresses have been working prior to 2026.8. However, this requirement is not listed under breaking changes in the release notes for 2026.8.
### Expected behavior
One of the following would be expected:
1. Plain IP addresses should continue to be accepted as trusted proxy entries, as in previous behavior.
2. Or, if only CIDR notation is now supported, authentik should fail with a clear validation error, for example:
```plain text
Invalid value for AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS: "172.16.0.15" is not valid CIDR notation. Use "172.16.0.15/32" for a single IPv4 address.
```
Additionally, if this is an intentional change, it should be documented as a breaking change in the release notes.
---
### Fix / Workaround
Changing the plain IP address to explicit CIDR notation fixes the issue:
```yaml
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS: 127.0.0.0/8, 172.16.0.15/32
```
After this change, the server starts successfully.
### How to reproduce
Set env for AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS to a singe ip without CIDR suffix
```yaml
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS: 127.0.0.0/8, 172.16.0.15
```
### Expected behavior
One of the following would be expected:
1. Plain IP addresses should continue to be accepted as trusted proxy entries, as in previous behavior.
2. Or, if only CIDR notation is now supported, authentik should fail with a clear validation error, for example:
```plain text
Invalid value for AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS: "172.16.0.15" is not valid CIDR notation. Use "172.16.0.15/32" for a single IPv4 address.
```
Additionally, if this is an intentional change, it should be documented as a breaking change in the release notes.
### Screenshots
_No response_
### Additional context
_No response_
### Deployment Method
Docker
### Version
2026.8.0
### Relevant log output
```shell
0: invalid IP address syntax
```
Contributor guide
Assessment
This issue has not been assessed yet.