Security advisories

high2026-02-13

lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

GHSA-699m-4v95-rmpm · CVE-2026-26187

medium2026-01-15

lakeFS is Missing Timestamp Validation in S3 Gateway Authentication

GHSA-f2ph-gc9m-q55f · CVE-2025-68671

medium2025-11-03

lakeFS affected by unauthenticated access to API usage metrics

GHSA-h238-5mwf-8xw8 · CVE-2025-64179

medium2025-02-21

lakeFS allows an authenticated user to cause a crash by exhausting server memory

GHSA-j7jw-28jm-whr6 · CVE-2025-27100

medium2024-11-26

Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion

GHSA-hh33-46q4-hwm2 · CVE-2024-43784

medium2024-02-22

User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository

GHSA-fvv5-h29g-f6w5

high2023-12-12

lakeFS logs S3 credentials in plain text

GHSA-4rgc-5g6r-2rjf

medium2023-12-12

User with permission to write actions can impersonate another user when auth token is configured in environment variable

GHSA-26hr-q2wp-rvc5

medium2023-08-14

lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files

GHSA-9phh-r37v-34wh

high2022-09-23

lakeFS vulnerable to authenticated users deleting files they are not authorized to delete

GHSA-28q9-9c3g-v3f9

medium2021-10-28

Improper Access Control in github.com/treeverse/lakefs

GHSA-m836-gxwq-j2pm