github.com/treeverse/lakefs (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/treeverse/lakefs, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2026-26187 — CVSS 8.1 (high): lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter…
• CVE-2025-27100 — CVSS 6.5 (medium): lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user…
• CVE-2025-68671 — CVSS 6.5 (medium): lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps…
• CVE-2024-43784 — CVSS 5.7 (medium): lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials…
• CVE-2025-64179 — CVSS 5.3 (medium): lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing…