CVE-2026-48026 treeverse CVE debrief

Who should care

Defenders responsible for lakeFS deployments, particularly those with user-contributed content or public repositories, should assess exposure and prioritize upgrading to fixed versions.

Why it matters

CVE-2026-48026 is a high-severity vulnerability in lakeFS Web UI that allows XSS attacks. Defenders should prioritize upgrading to fixed versions (1.81.1 or 1.84.0) to prevent exploitation. Exposure requires write access to a repository branch and user interaction. Supported consequences include arbitrary JavaScript execution in the context of another user's authenticated session.

• Authenticated users may execute arbitrary JavaScript in their own session.
• An attacker can exploit this vulnerability to perform actions as another user.
• Defenders must verify and upgrade to fixed lakeFS versions to prevent exploitation.
• Exposure requires write access to a repository branch and user interaction.

Technical summary

The lakeFS Web UI is vulnerable to cross-site scripting (XSS) due to improper sanitization of markdown files. An attacker with write access to any repository branch can commit a malicious .md object, allowing arbitrary HTML/JavaScript execution in the context of another user's authenticated session. lakeFS fixes the issue in version 1.81.1 for open-source and 1.84.0 for Enterprise. Users should upgrade to these versions to prevent exploitation. The vulnerability requires write access to a repository branch and user interaction to be exploited. Supported consequences include arbitrary JavaScript execution in the context of another user's authenticated session.

Defensive priority

High

Recommended defensive actions

• Upgrade to lakeFS version 1.81.1 or later for open-source edition, or lakeFS Enterprise version 1.84.0 or later.
• Review and update configurations to prevent exploitation.
• Disable Markdown rendering for older versions using YAML configuration for Enterprise customers.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the lakeFS Web UI vulnerability. The lakeFS project has released fixes in versions 1.81.1 and 1.84.0 for open-source and enterprise editions, respectively.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.