CVE-2026-66006: LakeFS Authentication Bypass Vulnerability

CVE-2026-66006 Overview

CVE-2026-66006 is an authentication bypass vulnerability affecting lakeFS through version 1.83.0. The flaw resides in the /setup_comm_prefs endpoint, which fails to enforce authentication after initial setup completion. Unauthenticated attackers can send POST requests to this endpoint to overwrite operator metadata, including email, name, and company fields. Attackers can also modify security update preferences, disable security communications, and generate falsified telemetry events using the legitimate installation ID. The issue is tracked under [CWE-306: Missing Authentication for Critical Function] and was fixed in commit 71a45ee.

Critical Impact
Remote unauthenticated attackers can overwrite operator contact metadata and suppress security notifications on affected lakeFS deployments.

Affected Products

lakeFS versions through 1.83.0
lakeFS deployments exposing the /setup_comm_prefs endpoint
Installations prior to fix commit 71a45ee

Discovery Timeline

2026-07-24 - CVE-2026-66006 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66006

Vulnerability Analysis

lakeFS is an open-source data version control system for data lakes. During initial deployment, the /setup_comm_prefs endpoint collects operator communication preferences, including contact email, name, company, and consent for security update notifications. The endpoint is designed to be reachable during the setup phase without authentication. The vulnerability arises because the endpoint remains accessible and modifiable after setup completes.

Attackers who reach a network-accessible lakeFS instance can POST to /setup_comm_prefs and rewrite operator metadata associated with the installation. This allows adversaries to redirect security communications away from the legitimate operator, disable notifications entirely, or emit forged telemetry events that appear to originate from the installation. The forged telemetry uses the real installation ID, degrading the integrity of vendor-side analytics and incident notifications.

Root Cause

The root cause is a missing authentication check on a state-changing endpoint after the initial setup phase concludes. The endpoint does not validate whether setup has already been completed nor whether the caller possesses valid operator credentials. This maps directly to [CWE-306].

Attack Vector

Exploitation requires only network reachability to the lakeFS HTTP interface. No authentication, user interaction, or privileges are required. An attacker crafts a POST request to /setup_comm_prefs with attacker-controlled JSON fields for email, name, company, and preference flags. The server accepts and persists the overwrite. Technical exploitation details are documented in the VulnCheck Security Advisory and the GitHub Pull Request Review.

No verified public exploit code is available. See the GitHub Issue Discussion for maintainer context on the reproduction path.

Detection Methods for CVE-2026-66006

Indicators of Compromise

Unexpected POST requests to /setup_comm_prefs after the initial installation window has closed.
Changes to operator email, name, or company metadata that were not initiated by an administrator.
Telemetry events emitted from the installation ID that do not correlate with legitimate operator activity.
Disabled or altered security update notification preferences without a change management record.

Detection Strategies

Enable HTTP access logging on the lakeFS server and alert on any request to /setup_comm_prefs originating outside the setup window.
Baseline operator metadata values and monitor the underlying configuration store for unauthorized modifications.
Correlate lakeFS access logs with authentication events to identify state-changing calls that lack a corresponding authenticated session.

Monitoring Recommendations

Forward lakeFS application logs to a centralized logging or SIEM pipeline for retention and query.
Track the source IP distribution of requests to setup-phase endpoints and flag external or unexpected sources.
Alert on repeated POSTs to setup endpoints, which may indicate scripted overwrite attempts.

How to Mitigate CVE-2026-66006

Immediate Actions Required

Upgrade lakeFS to a version containing fix commit 71a45ee from the GitHub Commit Update.
Restrict network exposure of the lakeFS HTTP interface to trusted management networks until patched.
Audit operator metadata (email, name, company, notification preferences) and restore legitimate values if tampering is suspected.
Rotate the installation ID if forged telemetry events are a concern for downstream analytics.

Patch Information

The upstream fix is delivered in commit 71a45eeb1639d146d34b8effd7e86d077160ed7c, merged via Pull Request #10499. The patch adds authentication and setup-state enforcement to the /setup_comm_prefs handler, preventing overwrite after initial provisioning. Operators should upgrade to a lakeFS release that includes this commit.

Workarounds

Block external access to the /setup_comm_prefs path at a reverse proxy or ingress controller until the patched release is deployed.
Place lakeFS behind an authenticating gateway that enforces identity checks on all state-changing endpoints.
Monitor and alert on any POST to /setup_comm_prefs and investigate immediately if observed outside a known provisioning window.

bash

# Example nginx snippet to block external access to the vulnerable endpoint
location = /setup_comm_prefs {
    allow 10.0.0.0/8;      # internal management network
    deny  all;
    proxy_pass http://lakefs_upstream;
}