lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-f2ph-gc9m-q55f | lakeFS is Missing Timestamp Validation in S3 Gateway Authentication |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 15 Jan 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0. | |
| Title | lakeFS is Missing Timestamp Validation in S3 Gateway Authentication | |
| Weaknesses | CWE-294 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-01-15T22:35:44.495Z
Reserved: 2025-12-22T23:37:00.931Z
Link: CVE-2025-68671
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-15T23:15:49.573
Modified: 2026-01-15T23:15:49.573
Link: CVE-2025-68671
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses