GHSA-26hr-q2wp-rvc5
User with permission to write actions can impersonate another user when auth token is configured in environment variable
Impact
When lakeFS is configured with ALL of the following:
- Configuration option
auth.encrypt.secret_keypassed through environment variable - Actions enabled via configuration option
actions.enabled(default enabled)
then a user who can configure an action can impersonate any other user.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
ANY ONE of these is sufficient to prevent the issue:
Do not pass
auth.encrypt.secret_keythrough an environment variable.For instance, Kubernetes users can generate the entire configuration as a secret and mount that. This is described here.
Disable actions.
Limit users allowed to configure actions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
What each source reports
GitHub Advisories Score used
User with permission to write actions can impersonate another user when auth token is configured in environment variable
Impact
When lakeFS is configured with ALL of the following:
- Configuration option
auth.encrypt.secret_keypassed through environment variable - Actions enabled via configuration option
actions.enabled(default enabled)
then a user who can configure an action can impersonate any other user.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
ANY ONE of these is sufficient to prevent the issue:
Do not pass
auth.encrypt.secret_keythrough an environment variable.For instance, Kubernetes users can generate the entire configuration as a secret and mount that. This is described here.
Disable actions.
Limit users allowed to configure actions.
- Record
GHSA-26hr-q2wp-rvc5- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSV
User with permission to write actions can impersonate another user when auth token is configured in environment variable
Impact
When lakeFS is configured with ALL of the following:
- Configuration option
auth.encrypt.secret_keypassed through environment variable - Actions enabled via configuration option
actions.enabled(default enabled)
then a user who can configure an action can impersonate any other user.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
ANY ONE of these is sufficient to prevent the issue:
Do not pass
auth.encrypt.secret_keythrough an environment variable.For instance, Kubernetes users can generate the entire configuration as a secret and mount that. This is described here.
Disable actions.
Limit users allowed to configure actions.
- Record
GHSA-26hr-q2wp-rvc5- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVGO-2023-2397No score
User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs
User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs
- Record
GO-2023-2397- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/treeverse/lakefsGo | before 1.3.1 | 1.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-26hr-q2wp-rvc5 is a medium vulnerability (CVSS 6.2) in github.com/treeverse/lakefs, published December 12, 2023. No source lists public exploit code. Fixed in github.com/treeverse/lakefs 1.3.1.