CVE-2026-26187: Path Traversal in lakeFS

The core of this vulnerability lies in the local block adapter within lakeFS. Due to insufficient validation of user-supplied paths, an attacker can craft malicious requests that traverse outside of the intended directory structure. This allows them to access files and directories they should not have access to, potentially including those belonging to other namespaces or sibling directories. The impact can range from information disclosure (reading sensitive configuration files or data) to unauthorized modification of data or even gaining control over parts of the lakeFS instance. A successful exploitation could lead to significant data breaches and compromise the integrity of the data lake.

1. Reserved2026-02-11
2. Published2026-02-17
3. Modified2026-02-19
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-26187 is to upgrade to lakeFS version 1.77.0 or later, which includes the necessary fixes to prevent path traversal. If an immediate upgrade is not feasible, consider implementing stricter access controls and network segmentation to limit the potential blast radius of a successful attack. Review and harden the local block adapter configuration, ensuring that only authorized users and processes have access. While a WAF might offer some protection, it's not a substitute for patching the underlying vulnerability.