TI-2026-35469 CVE-2026-48026
lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML
Priority MEDIUM 40
lakeFS is an open-source tool that transforms object storage into a Git-like repositories.
Vulnerabilities
7 records
TI-2026-47004 CVE-2026-66006 · GHSA-87fc-9c43-8q4g
lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
Priority HIGH 70
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name…
TI-2026-21178 CVE-2026-26187 · GHSA-699m-4v95-rmpm
lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access
Priority LOW 36
lakeFS is an open-source tool that transforms object storage into a Git-like repositories.
TI-2025-42164 CVE-2025-68671 · GHSA-f2ph-gc9m-q55f
lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
Priority LOW 34
lakeFS is an open-source tool that transforms object storage into a Git-like repositories.
TI-2025-39622 CVE-2025-64179 · GHSA-h238-5mwf-8xw8
lakeFS: Unauthenticated access to API usage metrics
Priority LOW 30
lakeFS is an open-source tool that transforms object storage into a Git-like repositories.
TI-2025-19970 CVE-2025-27100 · GHSA-j7jw-28jm-whr6
An authenticated user can crash lakeFS by exhausting server memory
Priority LOW 29
lakeFS is an open-source tool that transforms your object storage into a Git-like repository.
TI-2024-29379 CVE-2024-43784 · GHSA-hh33-46q4-hwm2
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion
Priority LOW 26
lakeFS is an open-source tool that transforms object storage into a Git-like repository.