CVE-2025-68671

Katalog CVE

CVSS 4.8 · Medium EPSS 0,27%

Kerentanan Authentication Bypass by Capture-replay pada lakefs. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.

Rincian

Terbit di NVD

15 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/treeverse/lakeFS/security/advisories/GHSA-f2ph-gc9m-q55f advisory vendor
• https://github.com/treeverse/lakeFS/commit/92966ae611d7f1a2bbe7fd56f9568c975aab2bd8 patch
• https://github.com/treeverse/lakeFS/issues/9599 exploit · issue tracking