CVE-2026-66006

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/treeverse/lakeFS/commit/71a45eeb1639d146d34b8effd7e86d077160ed7c	Patch
https://github.com/treeverse/lakeFS/issues/10465	Exploit Issue Tracking
https://github.com/treeverse/lakeFS/pull/10499	Issue Tracking Patch
https://www.vulncheck.com/advisories/lakefs-unauthenticated-operator-metadata-overwrite-via-setup-comm-prefs	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lakefs:lakefs:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) lakeFS hasta la versión 1.83.0, corregido en el commit 71a45ee, contiene una vulnerabilidad de omisión de autenticación en el endpoint /setup_comm_prefs que permite a atacantes no autenticados sobrescribir metadatos del operador incluyendo correo electrónico, nombre y empresa después de la finalización de la configuración. Los atacantes pueden hacer POST a este endpoint para modificar las preferencias de actualización de seguridad, deshabilitar las comunicaciones de seguridad y activar eventos de telemetría falsificados utilizando el ID de instalación legítimo.

Information

Published : 2026-07-24 15:19

Updated : 2026-10-24 13:10

NVD link : CVE-2026-66006

Mitre link : CVE-2026-66006

CVE.ORG link : CVE-2026-66006

JSON object : View

Products Affected

lakefs

lakefs

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-66006", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66006", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T15:30:44.937431Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/treeverse/lakeFS", "vendor": "treeverse", "product": "lakeFS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.83.0"}, {"status": "unaffected", "version": "71a45eeb1639d146d34b8effd7e86d077160ed7c", "versionType": "git"}], "packageURL": "pkg:golang/github.com/treeverse/lakefs", "defaultStatus": "unaffected"}]}], "published": "2026-07-24T15:19:07.353", "references": [{"url": "https://github.com/treeverse/lakeFS/commit/71a45eeb1639d146d34b8effd7e86d077160ed7c", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/treeverse/lakeFS/issues/10465", "tags": ["Exploit", "Issue Tracking"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/treeverse/lakeFS/pull/10499", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/lakefs-unauthenticated-operator-metadata-overwrite-via-setup-comm-prefs", "tags": ["Patch", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID."}, {"lang": "es", "value": "lakeFS hasta la versi\u00f3n 1.83.0, corregido en el commit 71a45ee, contiene una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en el endpoint /setup_comm_prefs que permite a atacantes no autenticados sobrescribir metadatos del operador incluyendo correo electr\u00f3nico, nombre y empresa despu\u00e9s de la finalizaci\u00f3n de la configuraci\u00f3n. Los atacantes pueden hacer POST a este endpoint para modificar las preferencias de actualizaci\u00f3n de seguridad, deshabilitar las comunicaciones de seguridad y activar eventos de telemetr\u00eda falsificados utilizando el ID de instalaci\u00f3n leg\u00edtimo."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lakefs:lakefs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C90D0CA0-F74C-440E-B441-394E890824F5", "versionEndIncluding": "1.83.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}