CVE-2025-68671: lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
Impact LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. An attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire.
Patches This issue affects all versions of lakeFS up to and including v1.74.4.
The vulnerability has been fixed in version v1.75.0.
Users should upgrade to version v1.75.0.
Workarounds
Until upgraded, implement these mitigations:
- Use short-lived credentials - Rotate access keys frequently and deactivate old keys. For regular requests, captured requests only work until rotation. For presigned URLs, they remain valid until the credentials used to create them are deactivated. - Network controls - Restrict S3 gateway access to trusted networks/IPs to limit where replay attacks can originate.
Note: These workarounds reduce risk but do not fully eliminate the vulnerability.
References - Original issue: https://github.com/treeverse/lakeFS/issues/9599 - AWS Signature V4 Documentation: https://docs.aws.amazon.com/IAM/latest/UserGuide/referencesigv.html - AWS Signature V4 S3 Requests: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html - AWS Signature V2 Documentation: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html
Other sources
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68671?
CVE-2025-68671 has a high severity due to the potential for replay attacks resulting from missing timestamp validation.
How do I fix CVE-2025-68671?
To fix CVE-2025-68671, upgrade lakeFS to version 1.75.0 or later where timestamp validation has been implemented.
What impact does CVE-2025-68671 have on lakeFS users?
CVE-2025-68671 allows attackers to reuse captured signed requests, compromising the security of lakeFS's S3 gateway.
Are there any workarounds for CVE-2025-68671?
Currently, the recommended approach is to upgrade to the fixed version rather than seeking temporary workarounds.
Is CVE-2025-68671 being actively exploited?
There are reports indicating that CVE-2025-68671 could be exploited if attackers gain access to valid signed requests.