lakeFS Missing Authentication Vulnerability in Usage Report Summary Endpoint

A vulnerability exists in lakeFS versions prior to 1.71.0, where the /api/v1/usage-report/summary endpoint lacks proper authentication. This flaw allows anyone to access aggregate API usage data. Although no sensitive information is disclosed, the data could provide insights into service activity or uptime.

Impact

Exploitation of this vulnerability allows unauthorized access to aggregate API usage counts, which could indicate service activity or uptime.

Remediation

Users can upgrade to lakeFS version 1.71.0 or later. Alternatively, a load balancer or application-level firewall can be used to block access to the /api/v1/usage-report/summary endpoint.