What is the CVSS score of CVE-2026-23537?

CVE-2026-23537 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Feast Feature Server are affected by CVE-2026-23537?

Feast Feature Server, including deployments within Red Hat OpenShift AI environments, contains a critical remote file-write vulnerability accessible without authentication.. A patch is available.

How to fix or mitigate CVE-2026-23537?

Within 24 hours: Identify all Feast Feature Server instances and assess network exposure; determine if any RHOAI deployments are impacted. Within 7 days: Implement compensating controls including WAF rules blocking /save-document endpoint requests, network segmentation restricting Feature Server access to internal networks only, and filesystem integrity monitoring. Within 30 days: Monitor vendor security advisories for patch availability; if patching timeline exceeds organizational risk tolerance, evaluate alternative feature store solutions or consider decommissioning affected systems.

Feast Feature Server CVE-2026-23537

EUVD-2026-40997 CRITICAL

Missing Authorization (CWE-862)

2026-07-01 redhat

GHSA-4m9c-5f58-453x

Authentication Bypass RCE Denial Of Service Red Hat Openshift Ai Rhoai Feast Feast Feature Server Red Hat

9.1

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network endpoint with bypassable path checks gives AV:N/AC:L/PR:N; arbitrary write yields I:H and disk-exhaustion A:H, with no read so C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

9.1 CRITICAL

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 01, 2026 - 16:01 EUVD

Analysis Generated

Jul 01, 2026 - 14:53 vuln.today

DescriptionCVE.org

A vulnerability has been identified in the Feast Feature Server’s /save-document endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling an attacker to overwrite vital application configurations or startup scripts. Because this flaw requires no credentials or special privileges, any attacker with network access to the server can potentially compromise the integrity of the system. This could lead to unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution.

AnalysisAI

Arbitrary file write in the Feast Feature Server's /save-document endpoint lets an unauthenticated remote attacker write attacker-controlled JSON to the host filesystem, bypassing the endpoint's path restrictions to overwrite application configuration or startup scripts. Because no credentials are required (CVSS 9.1, PR:N), any network-reachable attacker can corrupt system integrity, cause denial of service through disk exhaustion, or potentially achieve remote code execution. This flaw also ships in Red Hat OpenShift AI (RHOAI), which bundles Feast; there is no public exploit identified at time of analysis and it is not in CISA KEV.

Technical ContextAI

Feast is an open-source feature store used in MLOps pipelines to serve machine-learning features at inference time; the Feature Server component exposes HTTP endpoints, including /save-document, for persisting document/feature data. The root cause is CWE-862 (Missing Authorization): the endpoint accepts write requests without verifying caller identity or privileges, and its filesystem-location guardrails are insufficient, allowing a path-restriction bypass to place files outside the intended directory. The affected component is identified in CPE data as cpe:2.3:a:feast:feast_feature_server and, downstream, cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai) across multiple RHOAI releases, indicating the vulnerable server is embedded in Red Hat's managed AI platform.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the code fix is tracked in https://github.com/red-hat-data-services/feast/pull/192, and Red Hat OpenShift AI users should consult https://access.redhat.com/security/cve/CVE-2026-23537 and bug https://bugzilla.redhat.com/show_bug.cgi?id=2429304 for the RHOAI errata and exact fixed release once published. Until a tagged patched version is applied, reduce exposure by restricting network access to the Feature Server so the /save-document endpoint is not reachable from untrusted networks (place it behind an authenticating reverse proxy or network policy / NetworkPolicy in OpenShift), and, if feasible, block or disable the /save-document route at the ingress - noting the trade-off that document-save functionality will break for legitimate clients. Enforcing least-privilege on the process account and mounting its working directory read-only where possible limits the impact of a successful overwrite, at the cost of disabling any legitimate write paths.