What’s Vulnerable › Vulnerabilities

CVE-2025-64179: lakeFS: Unauthenticated access to API usage metrics

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-06 · updated 2026-06-17
• Weakness: CWE-200

Description

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.

Affected products

• treeverse lakeFS: before 1.71.0

References

• https://github.com/treeverse/lakeFS/commit/1c8adab852dac2387fcb00a256402b308a610c60
• https://github.com/treeverse/lakeFS/security/advisories/GHSA-h238-5mwf-8xw8

Get alerted when CVE-2025-64179 or the next vulnerability affects your stack