Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2025-68671

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:7f6849ebc2f4beb37a3a16da3fc3ebfb56b3efc495932bd0a76dc05f37323a4a
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"lakeFS","vendor":"treeverse","versions":[{"status":"affected","version":"< 1.75.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:bbf8a39e65df8ef341e03ea0904824a86aa7ae4b65b7cfc7959760b90fec43f5 · sha256:cd19153b9724d4c1… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:bbf8a39e65df8ef341e03ea0904824a86aa7ae4b65b7cfc7959760b90fec43f5 · sha256:cd19153b9724d4c1… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-294","description":"CWE-294: Authentication Bypass by Capture-replay","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:bbf8a39e65df8ef341e03ea0904824a86aa7ae4b65b7cfc7959760b90fec43f5 · sha256:cd19153b9724d4c1… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"https://github.com/treeverse/lakeFS/commit/92966ae611d7f1a2bbe7fd56f9568c975aab2bd8","tags":["x_refsource_MISC"],"url":"https://github.com/treeverse/lakeFS/commit/92966ae611d7f1a2bbe7fd56f9568c975aab2bd8"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:bbf8a39e65df8ef341e03ea0904824a86aa7ae4b65b7cfc7959760b90fec43f5 · sha256:cd19153b9724d4c1… · /containers/cna/references/2
{"name":"https://github.com/treeverse/lakeFS/issues/9599","tags":["x_refsource_MISC"],"url":"https://github.com/treeverse/lakeFS/issues/9599"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:bbf8a39e65df8ef341e03ea0904824a86aa7ae4b65b7cfc7959760b90fec43f5 · sha256:cd19153b9724d4c1… · /containers/cna/references/1
{"name":"https://github.com/treeverse/lakeFS/security/advisories/GHSA-f2ph-gc9m-q55f","tags":["x_refsource_CONFIRM"],"url":"https://github.com/treeverse/lakeFS/security/advisories/GHSA-f2ph-gc9m-q55f"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:bbf8a39e65df8ef341e03ea0904824a86aa7ae4b65b7cfc7959760b90fec43f5 · sha256:cd19153b9724d4c1… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer