Replay Attack Vulnerability in lakeFS S3 Gateway Authentication
Summary
GHSA-f2ph-gc9m-q55f: lakeFS is Missing Timestamp Validation in S3 Gateway Authentication. Affects github.com/treeverse/lakefs versions < 1.75.0. Fixed in 1.75.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lakeFS is an open-source version control system for data that allows users to manage their data lakes with Git-like operations. It provides features such as branching, committing, and merging for data, making it easier for teams to collaborate on data projects. However, the S3 gateway component of lakeFS has a critical vulnerability that affects its authentication mechanism, specifically related to timestamp validation.
Vulnerability Detail
The vulnerability arises from lakeFS's S3 gateway failing to validate timestamps in authenticated requests. This oversight allows attackers to perform replay attacks by capturing valid signed requests through methods such as network interception or accessing logs. Once an attacker has a valid request, they can replay it multiple times until the credentials are rotated, even if the request was intended to expire. This can lead to unauthorized access and potential data breaches.
How To Fix
Latest published version: v1.88.0 as of 22 Oct 2026
go get github.com/treeverse/lakefs@v1.88.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.75.0
This is the first release that contains the fix.
go get github.com/treeverse/lakefs@v1.75.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Until an upgrade can be performed, users can implement the following mitigations: 1. Use short-lived credentials by rotating access keys frequently and deactivating old keys. For example, if using AWS, you can create new IAM user access keys and delete the old ones. 2. Implement network controls to restrict S3 gateway access to trusted networks or IP addresses to limit the potential for replay attacks.
Conclusion
In summary, the lakeFS S3 gateway vulnerability poses a significant risk due to its susceptibility to replay attacks stemming from inadequate timestamp validation. Users are strongly encouraged to upgrade to version 1.75.0 or implement the suggested workarounds to mitigate the risk until they can upgrade.
See every vulnerability recorded for github.com/treeverse/lakefs →
FAQ
The vulnerability allows replay attacks due to the lack of timestamp validation in authenticated requests to the S3 gateway.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring any installation.
If exploited, attackers can gain unauthorized access to your data by replaying valid requests, leading to data breaches and loss of integrity.
Yes, the vulnerability has been fixed in lakeFS version 1.75.0. Users are advised to upgrade to this version.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/treeverse/lakefs.
