| CVE-2026-26187 | CAO8.1 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used strings.HasPrefix() to verify t | 13/02/2026 |
| CVE-2025-68671 | TRUNG BÌNH4.8 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised syste | 15/01/2026 |
| CVE-2025-64179 | TRUNG BÌNH5.3 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information abo | 06/11/2025 |
| CVE-2025-27100 | TRUNG BÌNH6.5 | lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below ar | 21/02/2025 |
| CVE-2024-43784 | TRUNG BÌNH5.7 | lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit all of the previous user | 26/11/2024 |
| GO-2022-1019 | — | lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs | 21/08/2024 |
| GO-2022-0375 | — | Improper Access Control in github.com/treeverse/lakefs | 21/08/2024 |
| GO-2023-2398 | — | lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs | 21/08/2024 |
| GO-2023-2397 | — | User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs | 21/08/2024 |
| GO-2023-2012 | — | lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs | 21/08/2024 |
| GO-2024-2581 | — | User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs | 04/06/2024 |
| GHSA-fvv5-h29g-f6w5 | TRUNG BÌNH5.3 | User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository | 22/02/2024 |
| GHSA-4rgc-5g6r-2rjf | CAO8.4 | lakeFS logs S3 credentials in plain text | 12/12/2023 |
| GHSA-26hr-q2wp-rvc5 | TRUNG BÌNH6.2 | User with permission to write actions can impersonate another user when auth token is configured in environment variable | 12/12/2023 |
| GHSA-9phh-r37v-34wh | TRUNG BÌNH5.8 | lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files | 14/08/2023 |
| GHSA-28q9-9c3g-v3f9 | CAO | lakeFS vulnerable to authenticated users deleting files they are not authorized to delete | 23/09/2022 |
| GHSA-m836-gxwq-j2pm | TRUNG BÌNH5.7 | Improper Access Control in github.com/treeverse/lakefs | 28/10/2021 |