CVE-2026-66006

Katalog CVE

CVSS 5.3 · Medium EPSS 0,56%

Kerentanan Missing Authentication for Critical Function pada lakefs. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.

Rincian

Terbit di NVD

24 Juli 2026

Terakhir diubah

30 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 44,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/treeverse/lakeFS/commit/71a45eeb1639d146d34b8effd7e86d077160ed7c patch
• https://github.com/treeverse/lakeFS/pull/10499 issue tracking · patch
• https://www.vulncheck.com/advisories/lakefs-unauthenticated-operator-metadata-overwrite-via-setup-comm-prefs patch · advisory pihak ketiga
• https://github.com/treeverse/lakeFS/issues/10465 exploit · issue tracking