What is the CVSS score of CVE-2026-18947?

CVE-2026-18947 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L. EPSS exploitation probability: 0.5%.

Which versions of Feast are affected by CVE-2026-18947?

Red Hat OpenShift AI's Feast materialization API contains an authorization bypass (CVE-2026-18947, CVSS 8.5) enabling attackers with API access to corrupt feature data and trigger denial-of-service…. A patch is available.

How to fix or mitigate CVE-2026-18947?

Within 24 hours, identify all Red Hat OpenShift AI deployments with Feast materialization enabled and audit API access logs for suspicious requests lacking the feature_views field; document baseline API activity for anomaly detection. Within 7 days, implement network-level or API gateway-based access controls to restrict materialization endpoints, enable request validation and logging with alerting for malformed queries, and deploy rate limiting to throttle exploitation attempts. Within 30 days, audit feature store data integrity against backups, establish continuous automated consistency validation, subscribe to Red Hat Security Advisories for patch notifications, and document patch deployment procedures for rapid response once vendor releases a fix.

Feast CVE-2026-18947

EUVD-2026-55817 HIGH

Missing Authorization (CWE-862)

2026-08-10 redhat

GHSA-mvxh-8c54-7fwx

Authentication Bypass Denial Of Service Red Hat Openshift Ai Rhoai Red Hat

8.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

vuln.today AI

10.0 CRITICAL

Description explicitly states unauthenticated exploitation is possible (PR:N); 'significant resource consumption' and multi-tenant DoS warrants A:H over vendor's A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Red Hat

8.5 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 21:28 vuln.today

CVE Published

Aug 10, 2026 - 20:44 nvd

HIGH 8.5

DescriptionCVE.org

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.

AnalysisAI

Authorization bypass in Feast's materialization API endpoints within Red Hat OpenShift AI (RHOAI) permits full re-materialization of all feature views by sending a crafted request that omits the feature_views field, circumventing permission checks. The consequence is a multi-tenant Denial of Service through data corruption and significant resource exhaustion, impacting all tenants sharing the deployment. No public exploit code has been identified at time of analysis, but the bypass mechanism is straightforward - a structural omission in the request body - making independent rediscovery likely for any attacker with API access.

Technical ContextAI

Feast is an open-source feature store used in machine learning workflows to manage, store, and serve feature data. In Red Hat OpenShift AI (RHOAI), Feast is bundled as a core MLOps component exposed via REST endpoints. The vulnerable endpoints - /materialize and /materialize-incremental - are responsible for computing and writing feature values to the online store. The authorization logic appears to gate access based on which feature_views are specified in the request; when the field is omitted entirely, the permission check either skips validation or defaults to a permissive fallback, constituting an authorization bypass (analogous to CWE-285 or CWE-862 patterns, though no formal CWE is assigned). The scope change in the CVSS vector (S:C) reflects the multi-tenant impact: one request can trigger resource-intensive operations affecting all tenants on the shared platform. CPE data identifies the affected product as cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai):*:*:*:*:*:*:*:*, with version ranges not precisely bounded by the available CPE strings.

RemediationAI

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18947 for official patch guidance, as no specific patched RHOAI version is identified in the available data - patch version is not independently confirmed at time of analysis. Until a patch is applied, network-level access controls should restrict the /materialize and /materialize-incremental endpoints to known, authorized clients only; blocking unauthenticated or unexpected sources at the ingress layer (API gateway, network policy, or Kubernetes NetworkPolicy) is the most actionable compensating control, with the trade-off that legitimate ML pipeline automation may require allow-listing. As an additional control, validating that the feature_views field is present and non-empty in any API gateway or middleware layer before requests reach Feast would directly neutralize the bypass mechanism, though this requires awareness of the Feast API schema. Monitor Bugzilla ticket #2511164 for patch release updates.