CVE-2026-26187: lakeFS Local Block Adapter Path Traversal Vulnerability
Summary
CVE-2026-26187: Two path traversal vulnerabilities in the local block adapter allow authenticated users to read and write files outside their designated storage boundaries. Affects github.com/treeverse/lakefs versions < 1.77.0. Fixed in 1.77.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lakeFS is an open-source data versioning tool that allows users to manage data in a Git-like manner. It provides functionalities for version control, data lineage, and collaboration on data sets. The local block adapter is a component of lakeFS that enables users to store and manage data on local file systems. However, it has been found to be vulnerable to path traversal attacks, which can compromise data security.
Vulnerability Detail
The local block adapter in lakeFS contains two path traversal vulnerabilities that allow authenticated users to read and write files outside their designated storage boundaries. The first vulnerability arises from the inadequate validation of requested paths, allowing access to sibling directories with similar names. The second vulnerability permits attackers to exploit path traversal sequences in object identifiers, enabling access to files across different namespaces. This could lead to unauthorized access to sensitive data, potential data corruption, and privilege escalation.
How To Fix
Latest published version: v1.88.0 as of 22 Oct 2026
go get github.com/treeverse/lakefs@v1.88.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.77.0
This is the first release that contains the fix.
go get github.com/treeverse/lakefs@v1.77.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can configure the storage path with a unique name that is unlikely to be a prefix of other directories. Additionally, restricting filesystem permissions for the lakeFS process and ensuring no sensitive data exists in sibling directories can help mitigate the risk.
Conclusion
The lakeFS local block adapter has critical path traversal vulnerabilities that can lead to unauthorized access to sensitive data. Users are strongly advised to update to version 1.77.0 or later to mitigate these risks. Implementing the suggested workarounds can provide additional protection until the update is applied.
See every vulnerability recorded for github.com/treeverse/lakefs →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Versions of lakeFS up to and including 1.76.0 are affected by this vulnerability.
This vulnerability can allow attackers to read sensitive data from other repositories, write malicious files, and potentially escalate privileges.
No, this vulnerability only affects deployments using the local block adapter. Other storage backends like S3, GCS, and Azure are not affected.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/treeverse/lakefs.
