Replay Attack Vulnerability in lakeFS S3 Gateway

CVE-2025-68671

What is CVE-2025-68671?

The S3 gateway of lakeFS, an open-source tool designed to manage object storage as Git-like repositories, suffers from a vulnerability that permits replay attacks due to the lack of timestamp validation in authenticated requests. An attacker who intercepts a valid signed request—whether through network breaches, system compromises, or logs—can exploit this flaw. They can successfully replay the request until the legitimately associated credentials are rotated, undermining the intended expiration of the request. This issue was addressed in version 1.75.0, emphasizing the importance of updating to secure the system against such attacks.

References