Which versions of Feast are affected by CVE-2026-56121?

Feast, an open-source ML feature store, contains a critical vulnerability enabling unauthenticated remote attackers to execute arbitrary commands on production systems.. A patch is available.

Is there a public PoC exploit available for CVE-2026-56121?

Yes, a public proof-of-concept exploit is available for CVE-2026-56121. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-56121?

Within 24 hours: Identify all Feast installations and their versions; implement temporary network restrictions (firewall rules limiting registry server access to trusted hosts only) if immediate patching is not feasible; review access logs for suspicious gRPC ApplyFeatureView requests. Within 7 days: Upgrade all Feast instances to version 0.63.0 or later. Within 30 days: Perform forensic analysis of registry server logs for exploitation indicators; audit all systems and data accessed by Feast for signs of compromise; verify patch deployment across all instances and document remediation completion.

Feast CVE-2026-56121

Q: What is the CVSS score of CVE-2026-56121?

CVE-2026-56121 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-38801 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-24 VulnCheck

GHSA-q63x-9pfm-mjx4

Deserialization Python RCE Feast

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Pre-authorization dill.loads() over a network gRPC request gives AV:N/AC:L/PR:N/UI:N, and arbitrary code execution as the service account yields full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 24, 2026 - 15:51 vuln.today

Analysis Generated

Jun 24, 2026 - 15:51 vuln.today

DescriptionCVE.org

Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account.

Articles & Coverage 3

POC CVE-2026-56121: Feast <0.63.0 Pre-Auth RCE via gRPC Registry dill Deserialization (CVSS 9.8) Jun 30, 2026 News 3 New Python Vulnerabilities - 1 Critical, 2 High, 1 With POC Jun 25, 2026 News Critical RCE in Feast ML Feature Store (Python) - CVE-2026-56121 Jun 24, 2026

AnalysisAI

Remote code execution in Feast (the open-source ML feature store) before 0.63.0 lets remote attackers run OS commands as the feast service account by sending a crafted ApplyFeatureView gRPC request to the registry server. The registry base64-decodes the user_defined_function.body field of an OnDemandFeatureView and passes it to dill.loads() before any authorization check, so no credentials are required. A publicly available exploit code exists (reported by VulnCheck via huntr) and a vendor patch is available, though the flaw is not listed in CISA KEV.

Technical ContextAI

Feast is a feature store used in machine-learning pipelines to define, store and serve features; its registry server exposes a gRPC API for registering feature definitions. OnDemandFeatureViews support user-defined transformation functions whose Python body is serialized with dill (an extended pickle library) and shipped as a base64 blob in the user_defined_function.body field. The flaw is a classic CWE-502 unsafe deserialization: dill.loads()/pickle reconstructs arbitrary objects by invoking their __reduce__ method, which an attacker can craft to execute arbitrary code during deserialization. Because the decode-and-load happens in the ApplyFeatureView path before authorization is enforced, the dangerous sink is reachable by any client able to talk to the registry. The single affected component is identified by CPE cpe:2.3:a:feast-dev:feast.

RemediationAI

Vendor-released patch: upgrade to Feast 0.63.0 or later (https://github.com/feast-dev/feast/releases/tag/v0.63.0), which contains fix commit 835cda8e2c1359f1f496ad72701dbd6a73bdb25a. Until you can upgrade, restrict network reachability of the registry gRPC server so only trusted clients can reach it - place it behind firewall rules/network ACLs or a service mesh and require authenticated mutual-TLS, accepting that this breaks any unauthenticated registration workflows you currently depend on. Do not expose the registry server to untrusted networks or the internet, and run the feast process under a least-privileged account so a successful deserialization grants minimal OS reach. These are compensating controls only: the dill.loads() sink remains reachable for any client able to hit the endpoint until the upgrade is applied. See the VulnCheck advisory (https://www.vulncheck.com/advisories/feast-unauthenticated-rce-via-applyfeatureview-grpc-deserialization) for confirmation of affected paths.