CVE-2026-66006: medium-severity vulnerability in treeverse lakeFS
lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.6%
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
treeverse · lakeFSpublic PoCs found — 1
cve_referencegithub.com/treeverse/lakeFS/issues/10465unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — treeverse lakeFS
In the same product, most dangerous first.
CVE-2026-26187HIGHlakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory accessEPSS 0.5%CVE-2025-27100MEDIUMAn authenticated user can crash lakeFS by exhausting server memoryEPSS 0.4%CVE-2026-48026HIGHlakeFS vulnerable to stored XSS in rendered markdown previews via raw HTMLEPSS 0.4%CVE-2024-43784MEDIUMRe-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletionEPSS 0.4%CVE-2025-64179MEDIUMlakeFS: Unauthenticated access to API usage metricsEPSS 0.3%CVE-2025-68671MEDIUMlakeFS is Missing Timestamp Validation in S3 Gateway AuthenticationEPSS 0.3%