CVE-2025-68671: lakefs Authentication Bypass by Capture-replay

Vulnerability summary

CVE-2025-68671 is a medium (CVSS 6.5) Authentication Bypass by Capture-replay vulnerability in lakefs. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-01-2026
   PublishedVulnerability first disclosed.
2. 20-01-2026
   Last modifiedVulnerability information updated.

Description

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.

• CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).