PT-2026-3139 · Lakefs · Lakefs

Published 2026-01-15 · Updated 2026-01-26 · CVE-2025-68671

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.75.0

Description lakeFS's S3 gateway does not validate timestamps in authenticated requests, which allows for replay attacks. An attacker capturing a valid signed request can replay it until credentials are rotated, even after the request's intended expiration. The API endpoints are susceptible to this issue. The vulnerable parameters include those used in authenticated requests.

Recommendations Upgrade to version 1.75.0. Use short-lived credentials and rotate access keys frequently, deactivating old keys. Restrict S3 gateway access to trusted networks/IPs.

Exploit

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2025-68671

GHSA-F2PH-GC9M-Q55F

GO-2026-4321

SUSE-SU-2026:0292-1

Affected Products

Lakefs

References · 29

• 🔥 https://github.com/treeverse/lakeFS/issues/9599 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68671.json · Exploit
• https://github.com/treeverse/lakeFS/security/advisories/GHSA-f2ph-gc9m-q55f · Vendor Advisory
• https://github.com/treeverse/lakeFS/commit/92966ae611d7f1a2bbe7fd56f9568c975aab2bd8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-68671 · Security Note
• https://osv.dev/vulnerability/GHSA-f2ph-gc9m-q55f · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4321 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68671 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0292-1 · Vendor Advisory
• https://github.com/treeverse/lakeFS · Note
• https://github.com/treeverse/lakeFS/pull/9710 · Note
• https://suse.com/security/cve/CVE-2025-68388 · Note
• https://suse.com/security/cve/CVE-2026-23511 · Note
• https://suse.com/security/cve/CVE-2024-44905 · Note
• https://suse.com/security/cve/CVE-2017-18892 · Note