Vulnerability · Published Nov 6, 2025 · Assigned by GitHub_M
CVE-2025-64179lakeFS: Unauthenticated access to API usage metrics
Medium 5.3
In plain English
A medium-severity missing authorization in lakeFS from treeverse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/treeverse/lakefs | 1.71.0 | GHSA-h238-5mwf-8xw8 |
| Go | github.com/treeverse/lakefs | 1.71.0 | GO-2025-4090 |
Affected products (as reported)
Weakness: CWE-862, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N