CVE-2026-66006

MediumCVSS 5.3

Published: 24/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

Vulnerability in lakeFS up to version 1.83.0 allows authentication bypass in the /setup_comm_prefs endpoint. Unauthenticated attackers can overwrite operator metadata including email, name, and company, and modify security update preferences.

Risk Assessment

An attacker can disable security communications, falsify telemetry events, and take control of operator configuration.

Recommendation

Update lakeFS to the fixed version (commit 71a45ee) and restrict access to the /setup_comm_prefs endpoint to authenticated users only.

Other vulnerabilities in lakeFS

CVE-2026-48026High
lakeFS, an open-source tool for object storage management, prior to version 1.81.1 (open source) and 1.84.0 (enterprise) renders Markdown files from repository objects without sanitizing the resulting HTML. A user with write access can commit a .md object containing arbitrary HTML/JavaScript, which executes in another user's session.

Original NVD description (English source)

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.