Executive brief
lakeFS, an open-source data versioning tool, contains a security flaw in its setup configuration interface. An unauthenticated attacker can remotely overwrite administrative metadata, such as the operator's name, company, and email address. This allows attackers to disable security update notifications and send false telemetry data, potentially leaving the system vulnerable to future issues without the administrator's knowledge.
Technical details
An authentication bypass vulnerability exists in lakeFS through version 1.83.0 due to missing access controls on the /setup_comm_prefs API endpoint. While the endpoint is intended for initial setup, it remained accessible to unauthenticated POST requests even after the installation was initialized. An attacker can exploit this to overwrite stored operator metadata (email, name, company) and modify security update preferences, effectively opting the installation out of security communications. Additionally, the exploit allows the triggering of falsified telemetry events using the legitimate installation ID. The issue was addressed in commit 71a45ee by implementing a state check that rejects requests once communication preferences have been captured.
Affected products
- treeverse lakeFS through 1.83.0
Timeline
- 2026-05-25: disclosed: Vulnerability reported to vendor via email
- 2026-06-24: other: Public issue opened on GitHub
- 2026-07-23: patched: Fix merged into master branch
- 2026-07-24: advisory: CVE published to NVD