goauthentik / goauthentik/authentik

AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS with single IPs without CIDR suffix prevents startup in 2026.8.0

Open
#25,225 3 comments 1 reaction 2 assignees Claimed by @rissson View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

### Describe the bug

After upgrading to **authentik 2026.8.0**, setting `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS` with a plain IP address causes authentik to fail during startup with a imprecise error:

```plain text
0: invalid IP address syntax
```

The error does not indicate that `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS` is the problematic setting.

This appears to be a breaking change because single IPv4 addresses have been working prior to 2026.8. However, this requirement is not listed under breaking changes in the release notes for 2026.8.

### Expected behavior

One of the following would be expected:

1. Plain IP addresses should continue to be accepted as trusted proxy entries, as in previous behavior.
2. Or, if only CIDR notation is now supported, authentik should fail with a clear validation error, for example:

```plain text
Invalid value for AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS: "172.16.0.15" is not valid CIDR notation. Use "172.16.0.15/32" for a single IPv4 address.
```

Additionally, if this is an intentional change, it should be documented as a breaking change in the release notes.

---

### Fix / Workaround

Changing the plain IP address to explicit CIDR notation fixes the issue:

```yaml
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS: 127.0.0.0/8, 172.16.0.15/32
```

After this change, the server starts successfully.

### How to reproduce

Set env for AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS to a singe ip without CIDR suffix
```yaml
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS: 127.0.0.0/8, 172.16.0.15
```

### Expected behavior

One of the following would be expected:

1. Plain IP addresses should continue to be accepted as trusted proxy entries, as in previous behavior.
2. Or, if only CIDR notation is now supported, authentik should fail with a clear validation error, for example:

```plain text
Invalid value for AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS: "172.16.0.15" is not valid CIDR notation. Use "172.16.0.15/32" for a single IPv4 address.
```

Additionally, if this is an intentional change, it should be documented as a breaking change in the release notes.

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2026.8.0

### Relevant log output

```shell
0: invalid IP address syntax
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.