CVE-2026-66006

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66006
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66006.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66006
Published
2026-07-24T14:57:50.268Z
Modified
2026-07-28T03:55:56.302485536Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
Details

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66006.json",
    "cwe_ids": [
        "CWE-306"
    ]
}
References

Affected packages

Git / github.com/treeverse/lakefs

Affected ranges

Type
GIT
Repo
https://github.com/treeverse/lakefs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
20efc26748fb2709e65a6140be08bcc6e6fde36c
Fixed
71a45eeb1639d146d34b8effd7e86d077160ed7c
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.83.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.81.0
0.81.1
1.*
1.48.1
Other
ci/binary_without_archive
list
ls
hadoop-lakefs-0.*
hadoop-lakefs-0.1.11
hadoop-lakefs-0.1.12
hadoop-lakefs-0.1.14
hadoop-lakefs-0.1.15
hadoop-lakefs-0.1.17
hadoop-lakefs-0.18.0
hadoop-lakefs-0.2.0
hadoop-lakefs-0.2.1
hadoop-lakefs-0.2.5
lakefs-rclone-export-0.*
lakefs-rclone-export-0.3.0
lakefs-rclone-export-0.3.1
lakefs-spark-client-0.*
lakefs-spark-client-0.10.0
lakefs-spark-client-0.11.0
lakefs-spark-client-0.14.0
lakefs-spark-client-0.14.2
lakefs-spark-client-0.17.0
lakefs-spark-client-0.2.2
lakefs-spark-client-0.20.0
lakefs-spark-client-0.3.0
lakefs-spark-client-0.4.0
lakefs-spark-client-0.5.0
lakefs-spark-client-0.5.1
lakefs-spark-client-0.5.2
lakefs-spark-client-0.6.0
lakefs-spark-client-0.6.2
lakefs-spark-client-0.6.3
lakefs-spark-client-0.6.4
lakefs-spark-client-0.6.5
lakefs-spark-client-0.7.2
lakefs-spark-client-0.7.3
lakefs-spark-client-0.8.0
lakefs-spark-client-0.8.1
lakefs-spark-client-0.9.0
lakefs-spark-client-0.9.1
lakefs-spark-client-v0.*
lakefs-spark-client-v0.21.0
lakefs-spark-client-v0.22.0
v0.*
v0.10.0
v0.10.1
v0.10.2
v0.100.0
v0.101.0
v0.101.1
v0.102.0
v0.102.1
v0.102.2
v0.103.0
v0.104.0
v0.105.0
v0.106.0
v0.106.1
v0.106.2
v0.107.0
v0.107.1
v0.108.0
v0.109.0
v0.11.0
v0.11.1
v0.110.0
v0.111.0
v0.111.1
v0.111.2-RC.0
v0.112.0
v0.112.1
v0.113.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.16.1
v0.16.2
v0.17.0
v0.18.0
v0.19.0
v0.20.0
v0.20.1
v0.21.0
v0.21.1
v0.21.2
v0.21.3
v0.21.4
v0.22.0
v0.22.1
v0.23.0
v0.23.1
v0.30.0
v0.31.0
v0.31.1
v0.31.2
v0.32.0
v0.32.1
v0.33.0
v0.33.1
v0.40.0
v0.40.1
v0.40.2
v0.40.3
v0.41.0
v0.41.1
v0.42.0
v0.43.0
v0.44.0
v0.44.1
v0.45.0
v0.45.1
v0.46.0
v0.47.0
v0.48.0
v0.48.1
v0.49
v0.49.0
v0.50.0
v0.51.0
v0.52.0
v0.52.1
v0.52.2
v0.53.0
v0.53.1
v0.54.0
v0.55.0
v0.56.0
v0.57.0
v0.57.1
v0.57.2
v0.58.0
v0.58.1
v0.59.0
v0.60.0
v0.60.1
v0.61.0
v0.62.0
v0.63.0
v0.64.0
v0.65.0
v0.66.0
v0.67.0
v0.68.0
v0.69.0
v0.69.1
v0.70.0
v0.70.1
v0.70.2
v0.70.3
v0.70.4
v0.70.5
v0.70.6
v0.8.1
v0.8.2
v0.80.0
v0.80.1
v0.82.0
v0.83.0
v0.83.2
v0.83.3
v0.83.4
v0.84.0
v0.85.0
v0.86.0
v0.87.0
v0.87.1
v0.88.0
v0.89.0
v0.9.0
v0.90.0
v0.90.1
v0.91.0
v0.92.0
v0.93.0
v0.93.0-RC.0
v0.94.0
v0.94.1
v0.95.0
v0.96.0
v0.96.1
v0.97.0
v0.97.1
v0.97.2
v0.97.3
v0.97.4
v0.97.5
v0.98.0
v0.99.0
v0.99.1
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.11.1
v1.12.0
v1.12.1
v1.13.0
v1.14.0
v1.14.1
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.26.1
v1.27.0
v1.28.0
v1.28.1
v1.28.2
v1.29.0
v1.3.0
v1.3.1
v1.30.0
v1.30.1
v1.31.0
v1.31.1
v1.32.0
v1.32.1
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.37.0
v1.38.0
v1.39.0
v1.39.1
v1.39.1-test
v1.39.2
v1.4.0
v1.40.0
v1.41.0
v1.42.0
v1.43.0
v1.44.0
v1.45.0
v1.46.0
v1.47.0
v1.48.0
v1.48.1
v1.48.2
v1.49.0
v1.49.1
v1.5.0
v1.50.0
v1.51.0
v1.52.0
v1.53.0
v1.53.1
v1.54.0
v1.55.0
v1.56.0
v1.56.1
v1.57.0
v1.58.0
v1.59.0
v1.6.0
v1.60.0
v1.61.0
v1.62.0
v1.63.0
v1.64.0
v1.64.1
v1.65.0
v1.65.1
v1.65.2
v1.66.0
v1.67.0
v1.68.0
v1.69.0
v1.7.0
v1.70.0
v1.70.1
v1.71.0
v1.72.0
v1.73.0
v1.74.0
v1.74.1
v1.74.2
v1.74.3
v1.74.4
v1.75.0
v1.76.0
v1.77.0
v1.77.1
v1.78.0
v1.79.0
v1.8.0
v1.80.0
v1.81.0
v1.81.1
v1.82.0
v1.83.0
v1.84.0
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66006.json"