CVE-2025-64179: lakeFS affected by unauthenticated access to API usage metrics
5.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
11/3/2025
Updated
11/3/2025
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/treeverse/lakefs | go | < 1.71.0 | 1.71.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The analysis of the provided security advisory and the associated commit 1c8adab852dac2387fcb00a256402b308a610c60 clearly indicates that the vulnerability is a missing authentication check in the /api/v1/usage-report/summary endpoint. The patch directly modifies the GetUsageReportSummary function in pkg/api/controller.go to add the necessary authentication. Before the patch, this function would execute without verifying the user's identity, leading to information disclosure. Therefore, Controller.GetUsageReportSummary is the vulnerable function that would appear in a runtime profile when the vulnerability is exploited.
Vulnerable functions
Controller.GetUsageReportSummarypkg/api/controller.go
The vulnerability lies in the `GetUsageReportSummary` function, which, prior to the patch, did not perform any authentication checks. This allowed an unauthenticated attacker to access the `/api/v1/usage-report/summary` endpoint and retrieve API usage metrics. The patch adds an authentication check at the beginning of the function to ensure that only authenticated users can access this information.