8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26187

CVE-2026-26187: lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used strings.HasPrefix() to verify that requested paths fall within the configured storage directory. This check was insufficient because it validated only the path prefix without requiring a path separator, allowing access to sibling directories with similar names. Also, the adapter verified that resolved paths stayed within the adapter's base path, but did not verify that object identifiers stayed within their designated storage namespace. This allowed attackers to use path traversal sequences in the object identifier to access files in other namespaces. Fixed in version v1.77.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26187

CVE-2026-26187:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/treeverse/lakefs	go	<= 1.76.0	1.77.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the provided security advisory and the associated patch commit cbc106275357302a834280f133265dc39f1384ce. The vulnerability exists in the local block adapter of lakeFS and is a path traversal issue with two distinct vectors.

The commit modifies two functions in pkg/block/local/adapter.go, which are the sources of the vulnerabilities:

local.Adapter.verifyRelPath: The patch changes strings.HasPrefix(filepath.Clean(p), l.path) to strings.HasPrefix(filepath.Clean(p), l.path+string(filepath.Separator)). This directly addresses the "Prefix Bypass Vulnerability" described in the advisory, where sibling directories could be accessed because the check didn't enforce a directory boundary. The original function is therefore considered vulnerable as it performs an insufficient validation.
local.Adapter.extractParamsFromObj: This function is responsible for converting an object pointer into a physical path. The patch fundamentally changes the logic for path construction and validation. The original implementation joined the base path, namespace, and a user-controlled identifier, and then called the weak verifyRelPath. This allowed an attacker to use ../ in the identifier to traverse out of the intended namespace, as described in the "Namespace Escape via Identifier" section of the advisory. The new implementation first validates the namespace path itself and then ensures the final resolved path is strictly confined within that namespace's path. This function is the core of the second vulnerability, as it improperly handled user-controlled input (ptr.Identifier) leading to path traversal.

During exploitation, an operation like Get or Put on the local block adapter would be called. These operations would then call extractParamsFromObj to resolve the path, which in turn (in the vulnerable version) called verifyRelPath. Therefore, both extractParamsFromObj and verifyRelPath would appear in a runtime profile when the vulnerability is triggered.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-26187: lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

CVE-2026-26187:

8.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Technical Details

8.1

8.1

Basic Information

Basic Information

CVE-2026-26187: lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

8.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-26187: lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

CVE-2026-26187:

8.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

8.1

8.1

Basic Information

Basic Information

CVE-2026-26187: lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI