CVE-2025-68671: Github.com/treeverse/lakefs LakeFS Is Missing Timestamp Validation Vulnerability
MODERATECVE-2025-68671 is a MODERATE (CVSS 6.5) lakefs is missing timestamp validation vulnerability (CWE-294: Authentication Bypass by Capture-replay) affecting Github.com/treeverse/lakefs libraries in the Go ecosystem. The issue involves lakefs is missing timestamp validation in s3 gateway authentication. Remediation is available by upgrading affected packages to version 1.75.0.
CVE-2025-68671 at a Glance
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
How to Fix CVE-2025-68671
To remediate this vulnerability, upgrade all affected Github.com/treeverse/lakefs dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/treeverse/lakefs to 1.75.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/treeverse/lakefsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-68671, inspect your project dependencies for Github.com/treeverse/lakefs:
inspect dependencies for github.com/treeverse/lakefsAnalyze the terminal output to locate any version of Github.com/treeverse/lakefs in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.75.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-294: Authentication Bypass by Capture-replay, where a capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). In Github.com/treeverse/lakefs, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-68671 Affected Github.com/treeverse/lakefs Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/treeverse/lakefs
|
Go |
< 1.75.0
|
1.75.0
|
References
Frequently Asked Questions
What is CVE-2025-68671?
Which Github.com/treeverse/lakefs versions are affected?
What version fixes CVE-2025-68671?
Is github.com/treeverse/lakefs affected?
What is the CVSS score of CVE-2025-68671?
What CWE is associated with CVE-2025-68671?
How can I check Go dependencies for CVE-2025-68671?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-f2ph-gc9m-q55f",
"modified" : "2026-01-16T15:20:36Z",
"published" : "2026-01-15T21:14:55Z",
"aliases" : [ "CVE-2025-68671" ],
"summary" : "lakeFS is Missing Timestamp Validation in S3 Gateway Authentication",
"details" : "### Impact\nLakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. An attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire.\n\n### Patches\nThis issue affects all versions of lakeFS up to and including v1.74.4.\n\nThe vulnerability has been fixed in version v1.75.0.\n\nUsers should upgrade to version v1.75.0.\n\n### Workarounds\n\nUntil upgraded, implement these mitigations:\n\n- **Use short-lived credentials** - Rotate access keys frequently and **deactivate old keys**. For regular requests, captured requests only work until rotation. For presigned URLs, they remain valid until the credentials used to create them are deactivated.\n- **Network controls** - Restrict S3 gateway access to trusted networks/IPs to limit where replay attacks can originate.\n\nNote: These workarounds reduce risk but do not fully eliminate the vulnerability.\n\n### References\n- Original issue: https://github.com/treeverse/lakeFS/issues/9599\n- AWS Signature V4 Documentation: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html\n- AWS Signature V4 S3 Requests: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html\n- AWS Signature V2 Documentation: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/treeverse/lakefs"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.75.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/treeverse/lakeFS/security/advisories/GHSA-f2ph-gc9m-q55f"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-68671"
}, {
"type" : "WEB",
"url" : "https://github.com/treeverse/lakeFS/issues/9599"
}, {
"type" : "WEB",
"url" : "https://github.com/treeverse/lakeFS/pull/9710"
}, {
"type" : "WEB",
"url" : "https://github.com/treeverse/lakeFS/commit/92966ae611d7f1a2bbe7fd56f9568c975aab2bd8"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/treeverse/lakeFS"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-294" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-01-15T21:14:55Z",
"nvd_published_at" : "2026-01-15T23:15:49Z"
}
}