CVE-2026-66006 is an authentication bypass vulnerability in treeverse lakeFS affecting versions up to 1.83.0. The issue exists in the /setup_comm_prefs endpoint, which lacks proper authentication controls, allowing unauthenticated attackers to POST requests that overwrite critical operator metadata after setup completion. This includes modifying email, name, and company information, as well as altering security update preferences and disabling security communications. Attackers can also trigger falsified telemetry events using the legitimate installation ID. The vulnerability is addressed in commit 71a45ee.

Unauthenticated attackers can overwrite operator metadata and security preferences, potentially disabling security communications and causing falsified telemetry data to be sent. This could reduce the effectiveness of security updates and monitoring, impacting the integrity and security posture of the affected system. However, the vulnerability does not allow direct code execution or data exfiltration beyond the described metadata and preference manipulation.

A fix is available and implemented in commit 71a45ee. Users should upgrade lakeFS to a version that includes this commit or later. Since no official patch version number is provided, users must verify the presence of this commit or consult the vendor for the fixed release. Until upgraded, restrict access to the /setup_comm_prefs endpoint to trusted users only.