CVE-2025-64179 - CVE House

Back to Database

Status published Medium CVE-2025-64179

lakeFS: Unauthenticated access to API usage metrics

5.3 CVSS

Vulnerability Description

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64179

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from treeverse

View All →

lakeFS is Missing Timestamp Validation in S3 Gateway Authentication

An authenticated user can crash lakeFS by exhausting server memory

Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion

Affected Vendor

treeverse

View all reports →

Affected Software

lakeFS

Vulnerable Versions:

< 1.71.0

Timeline

Official Publish: November 6th, 2025

Last Modified: November 7th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-862 CWE-200

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel