CVE-2026-26187 - Vulnerability Analysis

Overview

lakeFS prior to 1.77.0 contains a path traversal vulnerability caused by insufficient path prefix validation in the local block adapter, letting authenticated users read and write files outside their storage boundaries, exploit requires user authentication.

Severity & Score

Impact

Authenticated users can read and write files outside their designated storage, potentially leading to unauthorized data access and modification.

Mitigation

Update to version 1.77.0 or later.

References

• https://github.com/treeverse/lakeFS/commit/cbc106275357302a834280f133265dc39f1384ce
• https://github.com/treeverse/lakeFS/releases/tag/v1.77.0
• https://github.com/treeverse/lakeFS/security/advisories/GHSA-699m-4v95-rmpm

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 13, 2026

🟠 CVE-2026-26187 - High (8.1) lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage bo... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26187/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner