Security
فارسی
All products

github.com/treeverse/lakefs

Go · Package
11 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
lakeFS is Missing Timestamp Validation in S3 Gateway AuthenticationCVE-2025-68671 · GHSA-F2PH-GC9M-Q55FVersion ranges need review. github.com/treeverse/lakefs Go Medium Fix reported
lakeFS affected by unauthenticated access to API usage metricsCVE-2025-64179 · GHSA-H238-5MWF-8XW8Version ranges need review. github.com/treeverse/lakefs Go Medium Fix reported
lakeFS allows an authenticated user to cause a crash by exhausting server memoryCVE-2025-27100 · GHSA-J7JW-28JM-WHR6Version ranges need review. github.com/treeverse/lakefs Go Medium Fix reported
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletionCVE-2024-43784 · GHSA-HH33-46Q4-HWM2Version ranges need review. github.com/treeverse/lakefs Go Medium Fix reported
User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repositoryGHSA-FVV5-H29G-F6W5 · GO-2024-2581Version ranges need review. github.com/treeverse/lakefs Go Medium Fix reported
lakeFS logs S3 credentials in plain textGHSA-4RGC-5G6R-2RJF · GO-2023-2398Version ranges need review. github.com/treeverse/lakefs Go High Fix reported
User with permission to write actions can impersonate another user when auth token is configured in environment variableGHSA-26HR-Q2WP-RVC5 · GO-2023-2397Version ranges need review. github.com/treeverse/lakefs Go Medium Fix reported
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML FilesGHSA-9PHH-R37V-34WH · GO-2023-2012Version ranges need review. github.com/treeverse/lakefs Go Medium Fix reported
lakeFS vulnerable to authenticated users deleting files they are not authorized to deleteGHSA-28Q9-9C3G-V3F9 · GO-2022-1019Version ranges need review. github.com/treeverse/lakefs Go High Fix reported
Improper Access Control in github.com/treeverse/lakefsGHSA-M836-GXWQ-J2PM · GO-2022-0375Version ranges need review. github.com/treeverse/lakefs Go Medium Fix reported
lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory accessCVE-2026-26187 · GHSA-699M-4V95-RMPMVersion ranges need review. github.com/treeverse/lakefs Go High Fix reported