EUVD-2026-55818
GHSA-gg2p-37pv-v7fq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Default feature-server path allows unauthenticated network UDF storage yielding RCE (PR:N, AC:L), with a scope change enabling cross-tenant data access and full C/I/A loss.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.
AnalysisAI
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions stored in the registry are serialized with Python's 'dill' library and deserialized without validation. In default configurations a remote attacker can store a malicious UDF and achieve unauthenticated code execution on the feature server; an authenticated attacker can bypass authorization during deserialization to run code on the registry server, enabling cross-tenant data access and lateral movement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The exploitable prerequisite is that the target runs Feast with its registry accepting user-defined functions serialized via dill, and that the attacker can reach the feature server or registry endpoint to store a UDF - per the description this works against default feature-server configurations with no authentication for that path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue rather than a high-CVSS-but-low-real-risk case: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) combines network reach, low complexity, and a scope change, and the description asserts unauthenticated RCE on the feature server in default configurations - a high-impact, low-precondition combination. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with reach to the Feast feature server crafts a malicious user-defined function whose serialized dill payload embeds arbitrary Python code, then stores it in the registry. When the feature server (default configuration) or the registry server deserializes that UDF, the embedded code executes in the server's context, giving the attacker code execution and, via the scope change, a foothold to access other tenants' data and move laterally. … |
| Remediation | No vendor-released patch version was included in the provided data, so upgrade to the fixed Feast / Red Hat OpenShift AI release identified in the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-18948) and Bugzilla 2511167 (https://bugzilla.redhat.com/show_bug.cgi?id=2511167) once you confirm the exact patched version there - do not rely on an invented version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Red Hat OpenShift AI deployments and determine whether Feast is enabled; immediately isolate feature servers from untrusted networks and document current network exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Openshift Ai Rhoai
View allAuthentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or
MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor alrea
Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today