CVE-2025-64179: lakeFS affected by unauthenticated access to API usage metrics

November 3, 2025 (updated November 7, 2025)

Missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime.

References

github.com/advisories/GHSA-h238-5mwf-8xw8
github.com/treeverse/lakeFS
github.com/treeverse/lakeFS/commit/1c8adab852dac2387fcb00a256402b308a610c60
github.com/treeverse/lakeFS/security/advisories/GHSA-h238-5mwf-8xw8
nvd.nist.gov/vuln/detail/CVE-2025-64179

Code Behaviors & Features

Detect and mitigate CVE-2025-64179 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →