CVE-2025-68671

The record

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.

Affected packages

Related vulnerabilities

• GO-2026-4321 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in… Same vulnerability
• GO-2026-4494 lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and… Also affects github.com/treeverse/lakefs
• CVE-2026-26187 lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Also affects github.com/treeverse/lakefs
• GO-2025-4090 lakeFS affected by unauthenticated access to API usage metrics in… Also affects github.com/treeverse/lakefs
• CVE-2025-64179 lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Also affects github.com/treeverse/lakefs
• CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
• CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
• CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb