CVE-2025-64179: fallo de gravedad media en treeverse lakeFS
lakeFS: Unauthenticated access to API usage metrics
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.3%
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
treeverse · lakeFSCVEs relacionadas — treeverse lakeFS
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-66006MEDIUMlakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefsEPSS 0.6%CVE-2026-26187HIGHlakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory accessEPSS 0.5%CVE-2025-27100MEDIUMAn authenticated user can crash lakeFS by exhausting server memoryEPSS 0.4%CVE-2024-43784MEDIUMRe-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletionEPSS 0.4%CVE-2026-48026HIGHlakeFS vulnerable to stored XSS in rendered markdown previews via raw HTMLEPSS 0.4%CVE-2025-68671MEDIUMlakeFS is Missing Timestamp Validation in S3 Gateway AuthenticationEPSS 0.3%