Vulnerabilities

TI-2026-47004 CVE-2026-66006 · GHSA-87fc-9c43-8q4g

lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

HIGH 70

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00555 Published 2026-07-24 Fixed CWE-306

TI-2026-21178 CVE-2026-26187 · GHSA-699m-4v95-rmpm

lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

LOW 36

lakeFS is an open-source tool that transforms object storage into a Git-like repositories.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00453 Published 2026-02-13 Fixed in 1.77.0 CWE-22

TI-2025-42164 CVE-2025-68671 · GHSA-f2ph-gc9m-q55f

lakeFS is Missing Timestamp Validation in S3 Gateway Authentication

LOW 34

lakeFS is an open-source tool that transforms object storage into a Git-like repositories.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00267 Published 2026-01-15 Fixed in 1.75.0 CWE-294

Vulnerabilities

Filters

lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

lakeFS is Missing Timestamp Validation in S3 Gateway Authentication