lakeFS: Unauthenticated access to API usage metrics_CVE-2025-64179

5.3 / 10

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.

Basic Information

ID CVE-2025-64179

Source GitHub_M

Published Nov 6, 2025 at 21:57

Affected Product

Vendor treeverse

Product lakeFS

Version < 1.71.0

Affected Versions treeverse lakeFS < 1.71.0

CWE Classification

CWE-862 CWE-200

References

{
    "lastseen": "",
    "description": "lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.",
    "published": "2025-11-06T21:57:18.234Z",
    "modified": "2025-11-06T21:57:18.234Z",
    "type": "cve",
    "title": "lakeFS: Unauthenticated access to API usage metrics",
    "source": "GitHub_M",
    "references": "https://github.com/treeverse/lakeFS/security/advisories/GHSA-h238-5mwf-8xw8\nhttps://github.com/treeverse/lakeFS/commit/1c8adab852dac2387fcb00a256402b308a610c60",
    "id": "CVE-2025-64179",
    "bulletinFamily": "",
    "cwe": [
        "CWE-862",
        "CWE-200"
    ],
    "cvelist": null,
    "sourceData": "treeverse lakeFS < 1.71.0",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "lakeFS",
    "version": "< 1.71.0",
    "vendor": "treeverse",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}