PT-2025-45013 · Lakefs · Lakefs

Published 2025-11-03 · Updated 2025-11-17 · CVE-2025-64179

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.71.0

Description lakeFS is a tool that transforms object storage into Git-like repositories. Versions 1.69.0 and below lack authentication for the /api/v1/usage-report/summary endpoint, allowing unauthorized access to aggregate API usage counts. This does not disclose sensitive data but may reveal information about service activity or uptime. The vulnerable endpoint is /api/v1/usage-report/summary.

Recommendations Versions prior to 1.71.0 should be updated to version 1.71.0 or later. As a workaround, block the request route /api/v1/usage-report/summary using a load-balancer or application level firewall.

Exploit

Fix

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

CVE-2025-64179

GHSA-H238-5MWF-8XW8

GO-2025-4090

Affected Products

Lakefs

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64179.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64179 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64179 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h238-5mwf-8xw8 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4090 · Vendor Advisory
• https://github.com/treeverse/lakeFS · Note
• https://github.com/treeverse/lakeFS/security/advisories/GHSA-h238-5mwf-8xw8 · Note
• https://github.com/treeverse/lakeFS/commit/1c8adab852dac2387fcb00a256402b308a610c60 · Note
• https://twitter.com/VulmonFeeds/status/1986580356003209628 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1oo83gr/resumen_diario_de_vulnerabilidades_04112025 · Reddit Post
• https://twitter.com/CVEnew/status/1986577133960073719 · Twitter Post
• https://t.me/CVEtracker/36722 · Telegram Post