GHSA-28q9-9c3g-v3f9
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete
Impact
Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete.
Patches
lakeFS v0.82.0 and later
Workarounds
Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts with "AWS".
References
advisories/GHSA-28q9-9c3g-v3f9
For more information
If you have any questions or comments about this advisory:
Ask on the lakeFS Slack #help channel Email us at security@treeverse.io
What each source reports
GitHub AdvisoriesNo score
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete
Impact
Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete.
Patches
lakeFS v0.82.0 and later
Workarounds
Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts with "AWS".
References
advisories/GHSA-28q9-9c3g-v3f9
For more information
If you have any questions or comments about this advisory:
Ask on the lakeFS Slack #help channel Email us at security@treeverse.io
- Record
GHSA-28q9-9c3g-v3f9- Weakness
- CWE-281, CWE-284
- Updated
- 2026-11-02
OSVNo score
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete
Impact
Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete.
Patches
lakeFS v0.82.0 and later
Workarounds
Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts with "AWS".
References
advisories/GHSA-28q9-9c3g-v3f9
For more information
If you have any questions or comments about this advisory:
Ask on the lakeFS Slack #help channel Email us at security@treeverse.io
- Record
GHSA-28q9-9c3g-v3f9- Weakness
- CWE-281, CWE-284
- Updated
- 2026-11-02
OSVGO-2022-1019No score
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs
- Record
GO-2022-1019- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/treeverse/lakefsGo | before 0.82.0 | 0.82.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-28q9-9c3g-v3f9 is a vulnerability with no CVSS score yet in github.com/treeverse/lakefs, published September 23, 2022. No source lists public exploit code. Fixed in github.com/treeverse/lakefs 0.82.0.