What is the CVSS score of CVE-2026-18941?

CVE-2026-18941 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Which versions of Feast feast-operator are affected by CVE-2026-18941?

Feast and feast-operator in Red Hat OpenShift AI (RHOAI) deployments ship with disabled authentication by default, exposing ML feature stores to unauthenticated remote attackers.. A patch is available.

How to fix or mitigate CVE-2026-18941?

Within 24 hours, identify all RHOAI deployments running Feast or feast-operator and confirm current network exposure of feature-server, registry-server, and offline-server endpoints; audit which endpoints are externally or cross-namespace reachable. Within 7 days, implement network segmentation via Kubernetes NetworkPolicy or firewall rules to restrict access to these endpoints to authorized internal consumers only, and deploy an API gateway or OAuth2 proxy in front of exposed endpoints to enforce authentication. Within 30 days, complete a full Feast inventory audit, establish authentication as mandatory for all deployments, configure tenant isolation and network policies as standard baselines, and monitor for patches from Red Hat-apply immediately when available.

Feast feast-operator CVE-2026-18941

EUVD-2026-55815 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-10 redhat

GHSA-2xfw-wg76-86w9

Authentication Bypass RCE Denial Of Service Red Hat Red Hat Openshift Ai Rhoai Red Hat

7.7

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

10.0 CRITICAL

Default no-auth exposes endpoints to unauthenticated network attackers (PR:N); RCE, data exfiltration, and DoS justify C:H/I:H/A:H; cross-tenant impact yields S:C.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

7.7 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 21:28 vuln.today

CVE Published

Aug 10, 2026 - 20:44 nvd

HIGH 7.7

DescriptionCVE.org

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.

AnalysisAI

Feast and feast-operator ship with a default 'no_auth' security configuration, leaving the feature-server, registry-server, and offline-server endpoints completely unauthenticated and accessible to any network-reachable attacker in Red Hat OpenShift AI (RHOAI) deployments. Exploitation enables three distinct high-impact outcomes: remote code execution via injection of a malicious User-Defined Function (UDF) onto the feature-server, denial of service by forcing full re-materialization of all tenant features, and unauthorized read access to cross-tenant feature data. No public exploit code has been identified at time of analysis and CISA KEV status is not confirmed, but the trivial exploitation conditions - no authentication, no interaction, default configuration - make this a realistic priority for any RHOAI operator.

Technical ContextAI

Feast is an open-source feature store used to define, store, and serve machine learning features. The feast-operator manages Feast deployments on Kubernetes/OpenShift. The CVE is rooted in CWE-306 (Missing Authentication for Critical Function): the SDK and operator both default to a 'no_auth' mode, meaning no security manager or authentication provider is installed unless explicitly configured by the operator. The affected servers - feature-server (serves features to models), registry-server (stores feature definitions), and offline-server (serves historical data) - expose network-reachable APIs without any authentication gate. CPE data identifies the affected product as Red Hat OpenShift AI (RHOAI) across multiple version ranges (cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai):*). The UDF execution path is especially dangerous because feature stores frequently run feature transformation logic server-side with elevated privileges. The multi-tenant breach vector suggests the servers do not enforce tenant isolation in the absence of authentication.

RemediationAI

The primary remediation is to enable authentication on all Feast server endpoints by explicitly configuring a security manager in both the Feast SDK configuration and the feast-operator deployment manifests - replacing the default 'no_auth' mode with an appropriate authentication provider (e.g., OIDC, token-based, or Kubernetes RBAC-integrated auth). Operators should consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18941 for patched RHOAI versions and configuration guidance; no exact fix version is confirmed from the available data. As an immediate compensating control, restrict network access to the feature-server, registry-server, and offline-server endpoints using Kubernetes NetworkPolicy or OpenShift firewall rules so they are only reachable by authorized workloads and namespaces - this does not fix the missing authentication but reduces the exposed attack surface. Additionally, disable or restrict UDF execution on the feature-server if not required, as this is the RCE vector; the trade-off is loss of custom transformation capability. Audit deployed Feast configurations for any existing 'no_auth' settings and treat all currently exposed endpoints as potentially compromised pending patch application.