shouldiuse.io

VERDICT

Should I use lakeFS?

Bridging the data Infrastructure gap for AI. Ensure AI data governance, make AI training and agent runs reproducible, reduce access friction. - lakefs.io

Depends. Buy it if you run a serious AI or data platform on S3-style object storage and need reproducible, governed datasets. Skip it if you're a small team without dedicated data engineers — DVC or plain conventions are simpler and free.

Confidence

Medium. Based on 20+ public sources: reviews, Reddit threads, CVE databases, vendor docs, and news.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support evidence in sources
  • Security posture

Pricing

Free

Open Source (Community)

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
EnterpriseCustom quote

Best for

  • AI/ML teams on cloud data lakes
  • Regulated industries needing data governance
  • Reproducible training and agent runs
  • Write-audit-publish data pipelines

Not for

  • Small teams without platform engineers
  • Anyone without S3/GCS/Azure object storage
  • Buyers wanting turnkey SaaS simplicity
  • Client-only ML workflows — use DVC instead

Gotchas - check before you buy

high

Run the latest release: auth-bypass CVEs are fixed only in recent versions

medium

Enterprise pricing is quote-only; expect a sales call before any number

medium

Governance and compliance features are gated behind paid Enterprise tier

medium

Self-hosting adds Postgres and object-store operational burden

Pros and cons

Pros

  • Git-like branching and commits over object storage
  • Open-source core, free to self-host
  • Real enterprise adopters: Arm, Paige AI, EPCOR, Enigma
  • Endorsed on AWS storage blog; S3 Express One Zone integration
  • SOC2-compliant cloud edition available

Cons

  • Self-hosted: you run the server and Postgres metadata store
  • Four public CVEs in 2025–2026, two auth bypasses
  • Enterprise pricing quote-only, not published
  • Independent fit score just 2.5/5
  • Users debate DVC as simpler client-only alternative

Sources & method

Analyzed 9/22/2026 - 13 sources - Four CVEs in 2025–2026 including two auth bypasses, patched in recent releases; lakeFS Cloud is SOC2 compliant.

official x4review x4security x3news x2
  • CVE-2026-66006 — authentication bypass, Authentication bypass vulnerability disclosed July 2026.
  • CVE-2025-68671 — S3 gateway auth bypass, S3 gateway authentication bypass disclosed January 2026.
  • CVE-2026-48026 — Web UI XSS, Cross-site scripting in the web UI, disclosed August 2026.
  • CVE-2026-26187 — path traversal, Path traversal vulnerability disclosed February 2026.

Key stats

  • Value for money: 4/5

    Rating

  • Free

    Starting price

  • 13

    Sources

  • Analyzed

  • Value for money: 4/5. Free OSS core offsets opaque enterprise pricing
  • Ease of use: 3/5. Eases versioning, but needs server + Postgres ops
  • Feature depth: 4/5. Branching, merges, isolation, RBAC, enterprise controls
  • Support quality. No support evidence in sources
  • Security posture: 2/5. Recent CVEs include two auth bypasses
  • Yes Free tier Open-source core, self-hosted
  • $20M Funding Growth round, July 2025
  • 4+ Public CVEs 2025–2026, incl. 2 auth bypasses
  • 2.5/5 RFP.wiki fit score 2026 independent scoring

Pricing

Open Source (Community)

Free

  • Git-like versioning for object storage
  • Self-hosted
  • Community support

Enterprise

Not disclosed

  • RBAC and compliance controls
  • Support and SLAs
  • Self-hosted or cloud

Security

Four CVEs in 2025–2026 including two auth bypasses, patched in recent releases; lakeFS Cloud is SOC2 compliant.

  • CVE-2026-66006 — authentication bypassAuthentication bypass vulnerability disclosed July 2026.⁵
  • CVE-2025-68671 — S3 gateway auth bypassS3 gateway authentication bypass disclosed January 2026.
  • CVE-2026-48026 — Web UI XSSCross-site scripting in the web UI, disclosed August 2026.
  • CVE-2026-26187 — path traversalPath traversal vulnerability disclosed February 2026.

What users say

Users say lakeFS genuinely eases data versioning on object storage, but some prefer simpler client-only tools like DVC.

Companies that use it

  • Arm
  • Paige AI
  • EPCOR
  • Enigma Technologies
  • AirAsia¹
Full analysis

Based on 20+ public sources: reviews, Reddit threads, CVE databases, vendor docs, and news.

Git-for-data over object storage. Powerful for big AI data teams; ops-heavy and overkill for small ones.

Methodology

Based on 20+ public sources: reviews, Reddit threads, CVE databases, vendor docs, and news.

Sources

  1. lakeFS GitHub repositorygithub.com
    official
  2. lakeFS Pricinglakefs.io
    official
  3. lakeFS Editions documentationdocs.lakefs.io
    official
  4. lakeFS Security documentationdocs.lakefs.io
    security
  5. CVE-2026-66006 — NVDnvd.nist.gov
    security
  6. GHSA-87fc-9c43-8q4g advisorygithub.com
    security
  7. lakeFS and Amazon S3 Express One Zone — AWS blogaws.amazon.com
    news
  8. lakeFS Secures $20M in Growth Capital — PR Newswireprnewswire.com
    news
  9. LakeFS or DVC — Reddit r/mlopsreddit.com
    review
  10. Does lakeFS Actually Make Data Versioning Less Painful? — Sidersider.ai
    review
  11. lakeFS Not a Fit When — RFP.wikirfp.wiki
    review
  12. Nessie vs Iceberg vs LakeFS — Dremio blogdremio.com
    review
  13. lakeFS Case Studieslakefs.io
    official

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.