CVE-2026-66006

{
  "id": "CVE-2026-66006",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-24T15:19:07.353",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID."
    },
    {
      "lang": "es",
      "value": "lakeFS hasta la versión 1.83.0, corregido en el commit 71a45ee, contiene una vulnerabilidad de omisión de autenticación en el endpoint /setup_comm_prefs que permite a atacantes no autenticados sobrescribir metadatos del operador incluyendo correo electrónico, nombre y empresa después de la finalización de la configuración. Los atacantes pueden hacer POST a este endpoint para modificar las preferencias de actualización de seguridad, deshabilitar las comunicaciones de seguridad y activar eventos de telemetría falsificados utilizando el ID de instalación legítimo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "treeverse",
          "product": "lakeFS",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/treeverse/lakeFS",
          "packageURL": "pkg:golang/github.com/treeverse/lakefs",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.83.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "71a45eeb1639d146d34b8effd7e86d077160ed7c",
              "versionType": "git",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-24T15:30:44.937431Z",
          "id": "CVE-2026-66006",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:lakefs:lakefs:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "1.83.0",
              "matchCriteriaId": "C90D0CA0-F74C-440E-B441-394E890824F5"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/treeverse/lakeFS/commit/71a45eeb1639d146d34b8effd7e86d077160ed7c",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/treeverse/lakeFS/issues/10465",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ]
    },
    {
      "url": "https://github.com/treeverse/lakeFS/pull/10499",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://www.vulncheck.com/advisories/lakefs-unauthenticated-operator-metadata-overwrite-via-setup-comm-prefs",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ]
    }
  ]
}