Skip to content
OpenAdvisories

Package · Go

github.com/treeverse/lakefs

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-26187

    lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

    lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. Th…

    treeverse lakeFS github.com/treeverse/lakefs Go
  • High 8.4
    GHSA-4rgc-5g6r-2rjf

    lakeFS logs S3 credentials in plain text

    ### Impact S3 credentials are logged in plain text ``` S3Creds:{Key:AKIAIOSFODNN7EXAMPLE Secret:wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY ``` appears as part of the log message: ``` time="2023-05-12T13:51:52Z" level=error msg="failed to perform diff" func="pkg…

    github.com/treeverse/lakefs Go
  • High —
    GHSA-28q9-9c3g-v3f9

    lakeFS vulnerable to authenticated users deleting files they are not authorized to delete

    ### Impact Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete. ### Patches lakeFS v0.82.0 and later ### Workarounds Drop specific request to the lakeFS listen port. Any request wi…

    github.com/treeverse/lakefs Go