CVE-2026-48026: lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commit a .md object containing arbitrary HTML/JavaScript. Any other user who opens that object, or who navigates to a repository or directory containing a malicious README.md, executes the attacker-supplied script in their own authenticated session. lakeFS fixes the issue in v1.81.1 and lakeFS Enterprise fixes the issue in in v1.84.0. Enterprise customers using older versions can temporarily disable Markdown rendering by adding YAML to their config. No workaround exists for OSS release. Users are advised to upgrade to the latest version for both lakeFS and lakeFS-Enterprise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
lakeFS Web UIto a version that resolves this vulnerability.Fixed in 1.81.1 - Upgrade
Upgrade
lakeFS-Enterpriseto a version that resolves this vulnerability.Fixed in 1.84.0 - Configuration
For enterprise customers on older versions, temporarily disable Markdown rendering by adding the provided YAML to the lakeFS configuration (Markdown rendering must be disabled to mitigate the stored XSS in rendered markdown previews).
lakeFS Enterprise Markdown rendering = temporarily disable by adding YAML to config
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48026?
The severity of CVE-2026-48026 is high, with a score of 8.7.
How do I fix CVE-2026-48026?
To fix CVE-2026-48026, upgrade to lakeFS version 1.81.1 for the open source edition or 1.84.0 for the enterprise edition.
What type of vulnerability is CVE-2026-48026?
CVE-2026-48026 is a stored Cross-Site Scripting (XSS) vulnerability.
How does CVE-2026-48026 affect lakeFS users?
CVE-2026-48026 can allow malicious users to execute scripts in the context of other users via untrusted markdown previews.
Can CVE-2026-48026 affect all lakeFS deployments?
CVE-2026-48026 affects all lakeFS deployments prior to the specified versions, whether open source or enterprise.