EUVD-2026-83981Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fork contributor (PR:L) must lure a maintainer to approve (UI:R) then win a labeling race (AC:H); privileged CI job exposes external cloud credentials (S:C, C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_tests.yml uses pull_request_target with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain approval for a benign revision and then run changed code from refs/pull/${{ github.event.pull_request.number }}/merge through privileged make targets. The job exposes GCP, AWS, and Snowflake credentials to that code, enabling runner code execution, credential disclosure, and possible access to downstream cloud resources. An external label-removal integration could mitigate the condition, but no repository workflow provided that protection. This issue is fixed in version 0.65.0.
AnalysisAI
Code execution with access to GCP, AWS, and Snowflake credentials is possible in Feast's own CI pipeline prior to version 0.65.0, because the pr_integration_tests.yml workflow uses pull_request_target together with the synchronize event and preserves ok-to-test, approved, or lgtm labels on newly pushed commits. A fork contributor can get maintainer approval for a benign revision and then push altered commits that are checked out from refs/pull/${{ github.event.pull_request.number }}/merge and run through privileged make targets, resulting in runner code execution, credential disclosure, and possible access to downstream cloud resources; the CVSS vector indicates the attacker needs only a low-privilege GitHub identity (PR:L) plus a maintainer's approval action (UI:P), and no public exploit code was identified at the time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target repository to run the vulnerable .github/workflows/pr_integration_tests.yml (and pr_registration_integration_tests.yml) configuration prior to v0.65.0: pull_request_target triggered on the 'synchronize' event while preserving 'ok-to-test', 'approved', or 'lgtm' labels across newly pushed commits, and with cloud credentials (GCP, AWS, Snowflake) exposed to the job. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a classic GitHub Actions 'pwn-request' misconfiguration (CWE-863) in the Feast project's own CI/CD, not in deployed Feast instances - a critical scoping distinction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 0.65.0 (release tag v0.65.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, if your organization maintains a fork of feast-dev/feast or uses the pr_integration_tests.yml workflow with pull_request_target and synchronize events, disable or restrict that workflow, audit CI logs for suspicious pull request activity, and rotate any GCP, AWS, or Snowflake credentials accessible to affected runners. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Feast (the open-source ML feature store) before 0.63.0 lets remote attackers run OS commands as
Remote unauthenticated attackers can bypass all role-based access control on Feast feature servers (feast-dev/feast) thr
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Denial of service in the Feast Feature Server (the Python feature-store serving component, also shipped within Red Hat O
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today