CVE-2025-68671: lakeFS S3 Gateway Authentication Lacks Timestamp Validation
Summary
CVE-2025-68671: lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in github.com/treeverse/lakefs. Affects github.com/treeverse/lakefs versions < 1.75.0. Fixed in 1.75.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lakeFS is an open-source data versioning tool that allows users to manage their data lakes with Git-like functionality. It provides features such as branching, committing, and merging data changes, making it easier for teams to collaborate on data management. However, a vulnerability has been identified in its S3 Gateway Authentication mechanism, which could expose users to security risks.
Vulnerability Detail
The vulnerability arises from the absence of timestamp validation in the S3 Gateway Authentication process of lakeFS. This oversight allows unauthorized access to the system, potentially leading to data breaches or manipulation. Attackers could exploit this flaw to gain access to sensitive data or perform unauthorized actions within the lakeFS environment, compromising the integrity and confidentiality of the data stored.
How To Fix
Latest published version: v1.88.0 as of 22 Oct 2026
go get github.com/treeverse/lakefs@v1.88.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.75.0
This is the first release that contains the fix.
go get github.com/treeverse/lakefs@v1.75.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional security measures such as restricting access to the S3 Gateway and monitoring authentication requests for unusual patterns. However, this is not a substitute for updating to the patched version.
Conclusion
The vulnerability identified as CVE-2025-68671 in lakeFS poses significant risks due to the lack of timestamp validation in S3 Gateway Authentication. Users are strongly advised to update to version 1.75.0 or later to mitigate these risks and ensure the security of their data management processes.
See every vulnerability recorded for github.com/treeverse/lakefs →
FAQ
lakeFS is an open-source tool that provides Git-like capabilities for managing data lakes, allowing users to version, branch, and collaborate on data.
CVE-2025-68671 refers to a security flaw in lakeFS where the S3 Gateway Authentication lacks proper timestamp validation, potentially allowing unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing additional security measures such as access restrictions and monitoring authentication requests.
More information can be found in the official Go vulnerability database at https://pkg.go.dev/vuln/GO-2026-4321.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/treeverse/lakefs.
