CVE-2025-64179

The record

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.

Affected packages

Related vulnerabilities

• GO-2025-4090 lakeFS affected by unauthenticated access to API usage metrics in… Same vulnerability
• GO-2026-4494 lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and… Also affects github.com/treeverse/lakefs
• CVE-2026-26187 lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Also affects github.com/treeverse/lakefs
• GO-2026-4321 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in… Also affects github.com/treeverse/lakefs
• CVE-2025-68671 lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Also affects github.com/treeverse/lakefs
• CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
• CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
• CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200