{"cve":"CVE-2025-64179","nvd":{"published":"2025-11-06T22:15:44.463","modified":"2026-06-17T09:53:57.943","status":"Deferred","description":"lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-200","CWE-862"],"references":["https://github.com/treeverse/lakeFS/commit/1c8adab852dac2387fcb00a256402b308a610c60","https://github.com/treeverse/lakeFS/security/advisories/GHSA-h238-5mwf-8xw8"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:14:53.307938015+00:00"},"epss":{"cve":"CVE-2025-64179","score":0.00288,"percentile":0.21369,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-h238-5mwf-8xw8","url":"https://osv.dev/vulnerability/GHSA-h238-5mwf-8xw8","summary":"lakeFS affected by unauthenticated access to API usage metrics","modified":"2025-11-17T19:58:27.108035Z","packages":[{"ecosystem":"Go","name":"github.com/treeverse/lakefs","purl":"pkg:golang/github.com/treeverse/lakefs","ranges":["<1.71.0"],"fixed":["1.71.0"]}]},{"id":"GO-2025-4090","url":"https://osv.dev/vulnerability/GO-2025-4090","summary":"lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs","modified":"2026-03-03T04:57:06.139568Z","packages":[{"ecosystem":"Go","name":"github.com/treeverse/lakefs","purl":"pkg:golang/github.com/treeverse/lakefs","ranges":["<1.71.0"],"fixed":["1.71.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}