Threat Intelligence Database

CVE-2026-48026 is a cross-site scripting (XSS) vulnerability in the lakeFS Web UI that allows users with write access to commit markdown files containing malicious HTML/JavaScript. When other users view these files or navigate to directories containing them, the malicious script executes in their authenticated session. The issue affects versions prior to 1.81.1 of the open source edition and prior to 1.84.0 of the enterprise edition. lakeFS has fixed the vulnerability in these versions. Enterprise users on older versions can temporarily disable Markdown rendering via configuration, but no workaround exists for the open source edition. Users are advised to upgrade to the fixed versions.

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.