lakeFS anfällig für Path Traversal im lokalen Block-Adapter, ermöglicht Zugriff über Namespaces und Geschwisterverzeichnisse in github.com/treeverse/lakefs

The core of the vulnerability lies in the lakeFS local block adapter, which handles interactions with the underlying storage system. Due to insufficient validation of user-supplied paths, an attacker can craft malicious requests containing path traversal sequences (e.g., ../..) to navigate outside of the intended directory structure. This allows them to access files and directories they should not have access to, potentially including sensitive configuration files, data belonging to other users or namespaces, or even system files. The potential impact ranges from information disclosure to arbitrary file manipulation, depending on the permissions of the affected user and the accessibility of the targeted files. Successful exploitation could lead to a complete compromise of the lakeFS instance and the data it manages.

Organizations using lakeFS for data lake management, particularly those with multi-tenant deployments or shared namespaces, are at increased risk. Legacy lakeFS configurations with relaxed access controls are also more vulnerable. Teams relying on lakeFS for sensitive data storage should prioritize patching.

• go / application: Inspect lakeFS configuration files for unusual path entries. Monitor lakeFS logs for suspicious file access attempts, particularly those involving .. sequences.

find /opt/lakefs/ -path "*/..*" -print

• generic web: Monitor access logs for requests containing path traversal sequences (e.g., ../../../../etc/passwd). • generic web: Check response headers for unexpected file disclosures. • generic web: Use curl to probe for directory traversal:

curl -v 'http://your-lakefs-instance/../../../../etc/passwd' 2>&1 | grep 'HTTP/1.1 200 OK'

1. 2026-02-17Disclosure

   disclosure

1. Reserviert2026-02-11
2. Veröffentlicht2026-02-17
3. Geändert2026-02-19
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-26187 is to upgrade to lakeFS version 1.77.0 or later, which includes the necessary fixes to prevent path traversal. If upgrading immediately is not feasible, consider implementing stricter access controls and file system permissions to limit the potential damage from a successful attack. While not a complete solution, a Web Application Firewall (WAF) configured to block requests containing suspicious path traversal sequences can provide an additional layer of defense. Regularly review and audit lakeFS configurations to ensure they adhere to security best practices.