GHSA-h238-5mwf-8xw8MediumCVSS 5.3

lakeFS affected by unauthenticated access to API usage metrics

Published
November 3, 2025
Last Modified
November 7, 2025

🔗 CVE IDs covered (1)

CVE-2025-64179 →

📋 Description

Impact

Missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime.

Patches

Upgrade to >v1.70.1

Workarounds

Any ONE of these is sufficient to block this reporting:

  • Disable usage reporting by setting configuration option usage_report.enabled or environment variable LAKEFS_USAGE_REPORT_ENABLED to false.
  • Using load-balancer or application level firewall - blocking the request route /api/v1/usage-report/summary.

🎯 Affected products1

  • go/github.com/treeverse/lakefs:< 1.71.0

🔗 References (4)