Executive brief
lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access in github.com/treeverse/lakefs
Affected products
- Go github.com/treeverse/lakefs
Junglewise Threat Intelligence
CVE-2026-26187: GO-2026-4494 - lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access in github.com/treeverse/lakefs
CVE-2026-26187 · Severity: low · CVSS 3.1 · Published 2026-02-17
Technologies: github.com/treeverse/lakefs (Go). Vendors: Go.
Related threats
- GO-2026-4321 - lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in github.com/treeverse/lakefs
- GO-2025-4090 - lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs
- GO-2025-3479 - lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs
- GO-2024-3291 - Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lak
- GO-2022-1019 - lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs