~ / search / GHSA-h238-5mwf-8xw8

GHSA-h238-5mwf-8xw8

lakeFS affected by unauthenticated access to API usage metrics

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-64179

Packages

EcosystemPackageAffectedFixed in
Go github.com/treeverse/lakefs < 1.71.0 1.71.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Missing authentication in the `/api/v1/usage-report/summary` endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. ### Patches Upgrade to >v1.70.1 ### Workarounds Any **ONE** of these is sufficient to block this reporting: - Disable usage reporting by setting configuration option `usage_report.enabled` or environment variable `LAKEFS_USAGE_REPORT_ENABLED` to `false`. - Using load-balancer or application level firewall - blocking the request route /api/v1/usage-report/summary.

References

External links from the advisory. They lead to third-party sites.