CVE-2025-68671 - CVE House
Back to Database
Status published Medium CVE-2025-68671

lakeFS is Missing Timestamp Validation in S3 Gateway Authentication

Vulnerability Description

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68671

Credits & Attribution

No credits recorded in the NVD database.

References

More from treeverse

View All →
CVE-2025-64179
lakeFS: Unauthenticated access to API usage metrics
Medium 5.3
CVE-2025-27100
An authenticated user can crash lakeFS by exhausting server memory
Medium 6.5
CVE-2024-43784
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion
Medium 5.7

Affected Vendor

Affected Software

lakeFS
Vulnerable Versions:
< 1.75.0

Timeline

Official Publish: January 15th, 2026
Last Modified: January 20th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-294

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.