PT-2026-64319 · Treeverse · Lakefs

George Chen · CVE-2026-66006 · Publicado 2026-07-24 · Atualizado 2026-07-24

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup comm prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-66006

Produtos afetados

Lakefs

Referências · 5

• 🔥 https://github.com/treeverse/lakeFS/issues/10465 · Exploit
• https://github.com/treeverse/lakeFS/pull/10499 · Nota
• https://github.com/treeverse/lakeFS/commit/71a45eeb1639d146d34b8effd7e86d077160ed7c · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-66006 · Nota de Segurança
• https://vulncheck.com/advisories/lakefs-unauthenticated-operator-metadata-overwrite-via-setup-comm-prefs · Nota