Improper Access Control in github.com/treeverse/lakefs
Summary
GHSA-m836-gxwq-j2pm: Improper Access Control in github.com/treeverse/lakefs. Affects github.com/treeverse/lakefs versions < 0.53.1. Fixed in 0.53.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/treeverse/lakefs is a Go package that provides a versioned data lake management service. It allows users to manage and version large amounts of data stored in cloud object storage systems like Amazon S3. The package offers features such as branch and tag management, commit tracking, and object storage. However, a vulnerability has been identified in the package that could lead to improper access control.
Vulnerability Detail
The vulnerability in github.com/treeverse/lakefs allows a user with write permissions to a portion of a repository to use the S3 gateway to copy any object in the repository if they know its name. Additionally, a user with permission to write any one of tags, branches, or commits on a repository may write all of them. Furthermore, a user with permission to read any one of tags, branches, or commits on a repository may read all of them. Lastly, a user allowed to list objects in a repository or read repository metadata may retrieve graveler information about the location on underlying storage of all objects stored in any commit that they can view. If the user also has the capability to read underlying storage, they will be able to retrieve metadata associated with all objects in that commit. These vulnerabilities can potentially lead to unauthorized access, data leakage, and manipulation of repository objects.
How To Fix
Latest published version: v1.88.0 as of 22 Oct 2026
go get github.com/treeverse/lakefs@v1.88.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.53.1
This is the first release that contains the fix.
go get github.com/treeverse/lakefs@v0.53.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the package to mitigate the risk.
Conclusion
The vulnerability in github.com/treeverse/lakefs exposes users to potential unauthorized access, data leakage, and manipulation of repository objects. It is crucial to update to the fixed version of the package (0.53.1 or later) to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/treeverse/lakefs →
FAQ
The impact of this vulnerability includes unauthorized access to repository objects, potential data leakage, and manipulation of tags, branches, and commits.
Users of the github.com/treeverse/lakefs package who have write or read permissions to repositories are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this advisory.
Yes, a fix is available in version 0.53.1 of the github.com/treeverse/lakefs package. Users should update their dependencies to the latest version to address the vulnerability.
For more information, you can email the package maintainers at security@treeverse.io or open an issue on the github.com/treeverse/lakefs repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/treeverse/lakefs.
