lakefs records
3 published records for vendor lakefs.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 66.7%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-294 Authentication Bypass by Capture-replay1
- CWE-306 Missing Authentication for Critical Function1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
3 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
32Monitor | CVE-2026-26187No exploit | lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory accesslakefs · lakefs · CWE-22 | High8.1 | 0.4%Feb 13, 2026 |
27Monitor | CVE-2026-66006No exploit | lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefslakefs · lakefs · CWE-306 | Medium6.9 | 0.5%Jul 24, 2026 |
19Monitor | CVE-2025-68671No exploit | lakeFS is Missing Timestamp Validation in S3 Gateway Authenticationlakefs · lakefs · CWE-294 | Medium4.8 | 0.2%Jan 15, 2026 |
- CVE-2026-2618732Monitor
lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access
HighCVSS 8.1No exploitEPSS 0%lakefs · lakefsFeb 13, 2026
- CVE-2026-6600627Monitor
lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
MediumCVSS 6.9No exploitEPSS 0%lakefs · lakefsJul 24, 2026
- CVE-2025-6867119Monitor
lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
MediumCVSS 4.8No exploitEPSS 0%lakefs · lakefsJan 15, 2026