CVE-2026-66006
Received Received - Intake

Authentication Bypass in lakeFS via Setup Preferences Endpoint

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-66006
EUVD
EUVD-2026-48612

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
treeverse lakefs to 1.83.0 (inc)
lakefs lakefs to 1.83.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66006 is an authentication bypass vulnerability in lakeFS versions up to 1.83.0. The flaw exists in the /setup_comm_prefs endpoint, which allows unauthenticated attackers to overwrite operator metadata such as email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.

Detection Guidance

Check if your lakeFS instance is running version 1.83.0 or earlier. Inspect network traffic for POST requests to the /setup_comm_prefs endpoint from unauthorized sources. Monitor logs for repeated unauthorized modifications to operator metadata or falsified telemetry events.

Impact Analysis

This vulnerability allows attackers to manipulate critical operator details and security settings without authentication. They can disable security updates, falsify telemetry data, and potentially gain unauthorized control over the system's configuration. The impact includes compromised data integrity, misleading security alerts, and unauthorized system modifications.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by allowing unauthorized modifications to operator metadata and security settings. GDPR requires data integrity and security measures, while HIPAA mandates strict access controls. The flaw enables attackers to alter critical configurations, potentially violating these regulations and exposing organizations to legal and financial penalties.

Mitigation Strategies

Upgrade lakeFS to a version that includes the fix (commit 71a45ee or later). Ensure the /setup_comm_prefs endpoint is restricted to authenticated users only. Review and validate operator metadata for unauthorized changes. Monitor telemetry events for falsification attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart