Medium severity5.3NVD Advisory· Published Jul 24, 2026· Updated Jul 30, 2026
CVE-2026-66006
CVE-2026-66006
Description
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/treeverse/lakeFS/commit/71a45eeb1639d146d34b8effd7e86d077160ed7cnvdPatch
- github.com/treeverse/lakeFS/pull/10499nvdIssue TrackingPatch
- www.vulncheck.com/advisories/lakefs-unauthenticated-operator-metadata-overwrite-via-setup-comm-prefsnvdPatchThird Party Advisory
- github.com/treeverse/lakeFS/issues/10465nvdExploitIssue Tracking
News mentions
0No linked articles in our index yet.