{"cve":"CVE-2025-68671","nvd":{"published":"2026-01-15T23:15:49.573","modified":"2026-06-17T09:59:24.747","status":"Analyzed","description":"lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8},"cwes":["CWE-294"],"references":["https://github.com/treeverse/lakeFS/commit/92966ae611d7f1a2bbe7fd56f9568c975aab2bd8","https://github.com/treeverse/lakeFS/issues/9599","https://github.com/treeverse/lakeFS/security/advisories/GHSA-f2ph-gc9m-q55f"],"products":["lakefs:lakefs"],"source":"nvd","synced_at":"2026-10-19T22:19:41.481987139+00:00"},"epss":{"cve":"CVE-2025-68671","score":0.00267,"percentile":0.18886,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-f2ph-gc9m-q55f","url":"https://osv.dev/vulnerability/GHSA-f2ph-gc9m-q55f","summary":"lakeFS is Missing Timestamp Validation in S3 Gateway Authentication","modified":"2026-02-03T03:17:23.428241Z","packages":[{"ecosystem":"Go","name":"github.com/treeverse/lakefs","purl":"pkg:golang/github.com/treeverse/lakefs","ranges":["<1.75.0"],"fixed":["1.75.0"]}]},{"id":"GO-2026-4321","url":"https://osv.dev/vulnerability/GO-2026-4321","summary":"lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in github.com/treeverse/lakefs","modified":"2026-03-03T04:57:51.448682Z","packages":[{"ecosystem":"Go","name":"github.com/treeverse/lakefs","purl":"pkg:golang/github.com/treeverse/lakefs","ranges":["<1.75.0"],"fixed":["1.75.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}