PatchSiren cyber security CVE debrief
CVE-2026-66006 treeverse CVE debrief
The lakeFS installation contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint, allowing unauthenticated attackers to overwrite operator metadata, including email, name, and company, after setup completion. The issue is fixed in commit 71a45ee. This CVE record was published on 2026-07-24T15:19:07.353Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. Operators and users of lakeFS, especially those who have not applied the fix, should be aware of this vulnerability and take necessary actions to secure their installations. This includes verifying the fix, restricting access to the /setup_comm_prefs endpoint, and monitoring for unauthorized modifications to operator metadata. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Evidence is limited to public sources and may not cover all affected deployments or variations.
- Vendor
- treeverse
- Product
- lakeFS
- CVSS
- MEDIUM 6.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-24
- Original CVE updated
- 2026-07-28
- Advisory published
- 2026-07-24
- Advisory updated
- 2026-07-28
Who should care
Operators and users of lakeFS, especially those who have not applied the fix, should be aware of this vulnerability and take necessary actions to secure their installations. This includes verifying the fix, restricting access to the /setup_comm_prefs endpoint, and monitoring for unauthorized modifications to operator metadata. Security teams and vulnerability management teams should also review the CVE record and NVD entry to understand the affected scope and severity.
Technical summary
The lakeFS installation contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint. This allows unauthenticated attackers to overwrite operator metadata, including email, name, and company, after setup completion. The issue is fixed in commit 71a45ee. Operators should review their installations and apply the fix to prevent unauthorized modifications to operator metadata. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity.
Defensive priority
Operators of lakeFS should verify their installations and ensure that the fix is applied to prevent unauthorized modifications to operator metadata.
Recommended defensive actions
- Verify lakeFS installation and apply the fix from commit 71a45ee.
- Restrict access to the /setup_comm_prefs endpoint.
- Monitor for unauthorized modifications to operator metadata.
- Review and update security update preferences and communication settings.
- Trigger retest of lakeFS installation to ensure fix efficacy.
Evidence notes
The CVE record and NVD entry provide details on the authentication bypass vulnerability in lakeFS. The vulnerability allows unauthenticated attackers to overwrite operator metadata. The issue is fixed in commit 71a45ee. To verify the fix, operators should review their installations, ensure that the fix is applied, and monitor for unauthorized modifications to operator metadata. Evidence is limited to public sources and may not cover all affected deployments or variations.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-24T15:19:07.353Z and has not been modified since then.