lakeFS: Unauthenticated access to API usage metrics

published 2025-11-03 12 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-37514 , GHSA-h238-5mwf-8xw8 , GO-2025-4090

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits: 0; none known

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.

Patch / fix

fixed in 2 distros 1 links 1

go github.com/treeverse/lakefs 1.71.0
lakefs lakefs 1.71.0

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

github.com/treeverse/lakeFS@1c8adab commit

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 12 mo ago (2025-11-07)

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/treeverse/lakefs	<1.71.0	1.71.0

Affected products

treeverse lakeFS

Classification

Weakness

CWE-862 Missing Authorization
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

github.com /treeverse/lakeFS/commit/1c8adab852dac2387fcb00a256402b308a610c60
web
github.com /treeverse/lakeFS/security/advisories/GHSA-h238-5mwf-8xw8
web, advisory
nvd.nist.gov /vuln/detail/CVE-2025-64179
advisory
github.com /treeverse/lakeFS
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary