CVE-2026-66006 in lakeFS
Summary
by MITRE • 07/24/2026
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The lakeFS authentication bypass vulnerability represents a critical security flaw in versions 1.83.0 and earlier that undermines the platform's access control mechanisms through an improperly protected API endpoint. This vulnerability exists within the /setup_comm_prefs endpoint which should require proper authentication but instead accepts unauthenticated requests that can manipulate core operational metadata. The flaw allows attackers to modify essential operator information including email addresses, full names, and company details even after the initial setup process has been completed, effectively breaking the system's intended security boundaries.
The technical implementation of this vulnerability stems from inadequate input validation and authentication checks within the communication preferences management functionality. When attackers send POST requests to the /setup_comm_prefs endpoint without proper authentication tokens or session validation, the system processes these requests as if they originated from legitimate administrators. This misconfiguration enables arbitrary modification of security update preferences, which can be leveraged to disable critical security communications that would otherwise alert operators to potential threats. The vulnerability is particularly concerning because it operates through a legitimate installation ID mechanism that the system trusts for telemetry and communication purposes.
The operational impact of this authentication bypass extends beyond simple metadata manipulation to potentially compromise the integrity of the entire lakeFS deployment. Attackers can use this vulnerability to disable security communications, effectively creating blind spots in the system's monitoring capabilities while simultaneously enabling them to send falsified telemetry events that could mislead administrators about the actual state of their deployment. This capability allows malicious actors to obscure their presence by manipulating security update preferences and disabling notifications that would otherwise flag suspicious activities. The vulnerability also undermines trust in the system's telemetry data, as attackers can inject false information into the communication channels.
Security professionals should note this vulnerability aligns with CWE-287 which addresses improper authentication mechanisms, and it maps to ATT&CK technique T1566 related to credential harvesting and manipulation. Organizations running lakeFS versions prior to the fix should immediately implement network segmentation controls to restrict access to the /setup_comm_prefs endpoint and monitor for unusual communication pattern changes. The recommended mitigation includes applying the patch from commit 71a45ee which properly enforces authentication requirements for all requests to this endpoint, ensuring that only authenticated users with appropriate privileges can modify communication preferences and security update settings.
Additional defensive measures should include implementing strict access controls around administrative endpoints, enabling comprehensive logging of all communication preference modifications, and establishing monitoring rules that flag unauthorized changes to operator metadata. Organizations should also consider deploying web application firewalls to detect and block suspicious POST requests to sensitive endpoints, while ensuring that the legitimate installation ID mechanism includes proper cryptographic validation to prevent unauthorized usage. Regular security audits of API endpoint access controls remain essential for identifying similar authentication bypass vulnerabilities in other components of the system architecture.