What’s Vulnerable › Vulnerabilities

CVE-2025-68671: lakeFS is Missing Timestamp Validation in S3 Gateway Authentication

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-15 · updated 2026-06-17
• Weakness: CWE-294

Description

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.

Affected products

• treeverse lakeFS: before 1.75.0 — fixed in 1.75.0

How to fix

Upgrade to a fixed version: treeverse lakeFS 1.75.0. Check the vendor advisory for mitigations.

References

• https://github.com/treeverse/lakeFS/commit/92966ae611d7f1a2bbe7fd56f9568c975aab2bd8
• https://github.com/treeverse/lakeFS/issues/9599
• https://github.com/treeverse/lakeFS/security/advisories/GHSA-f2ph-gc9m-q55f

Get alerted when CVE-2025-68671 or the next vulnerability affects your stack