Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-66006— lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

Quick assessment

Affected
treeverse lakeFS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

lakefs是lakefs公司开源的一个数据湖版本控制平台。 lakeFS 1.83.0及之前版本存在授权问题漏洞，该漏洞源于/setup_comm_prefs端点存在身份验证绕过问题，允许未经身份验证的攻击者在设置完成后覆盖操作员元数据（包括电子邮件、名称和公司），通过POST请求修改安全更新偏好、禁用安全通信并使用合法安装ID触发伪造的遥测事件。

CVSS 5.3 · Medium EPSS 0.56% · P44

Affected Version Matrix 2

VendorProduct Version RangeStatus
treeverse lakeFS ≤ 1.83.0 affected
71a45eeb1639d146d34b8effd7e86d077160ed7c unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-66006

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
Source: CVE Program / CVE List V5
Vulnerability Description
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
lakeFS 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
lakefs是lakefs公司开源的一个数据湖版本控制平台。 lakeFS 1.83.0及之前版本存在授权问题漏洞，该漏洞源于/setup_comm_prefs端点存在身份验证绕过问题，允许未经身份验证的攻击者在设置完成后覆盖操作员元数据（包括电子邮件、名称和公司），通过POST请求修改安全更新偏好、禁用安全通信并使用合法安装ID触发伪造的遥测事件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
treeverse lakeFS 0 ~ 1.83.0 -

II. Public POCs for CVE-2026-66006

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-66006

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-66006 (2)

Vendor Advisories for CVE-2026-66006 (2)

IV. Related Vulnerabilities

Same product: lakeFS
Same vendor: treeverse
Same weakness: CWE-306

V. Comments for CVE-2026-66006

No comments yet

Leave a comment