What is the CVSS score of EUVD-2026-55818?

EUVD-2026-55818 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Feast are affected by EUVD-2026-55818?

Feast, the ML feature store bundled in Red Hat OpenShift AI, is vulnerable to unauthenticated remote code execution (CVSS 9.9) through malicious user-defined functions.. A patch is available.

How to fix or mitigate EUVD-2026-55818?

Within 24 hours: Inventory all Red Hat OpenShift AI deployments and determine whether Feast is enabled; immediately isolate feature servers from untrusted networks and document current network exposure. Within 7 days: Implement network segmentation to restrict Feast registry and feature server access to authorized internal IP ranges only; disable user-defined functions (UDF) capability if not actively required for production ML pipelines. Within 30 days: Establish communication with Red Hat support to confirm patch availability and release timeline; conduct data access audit on Feast instances to identify any unauthorized queries or suspicious activity; develop upgrade plan based on patch release schedule.

Feast EUVD-2026-55818

| CVE-2026-18948 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-10 redhat

GHSA-gg2p-37pv-v7fq

RCE Deserialization Red Hat Openshift Ai Rhoai Red Hat

9.9

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Default feature-server path allows unauthenticated network UDF storage yielding RCE (PR:N, AC:L), with a scope change enabling cross-tenant data access and full C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.9 CRITICAL

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 21:26 vuln.today

CVE Published

Aug 10, 2026 - 20:44 nvd

CRITICAL 9.9

DescriptionCVE.org

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.

AnalysisAI

Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions stored in the registry are serialized with Python's 'dill' library and deserialized without validation. In default configurations a remote attacker can store a malicious UDF and achieve unauthenticated code execution on the feature server; an authenticated attacker can bypass authorization during deserialization to run code on the registry server, enabling cross-tenant data access and lateral movement. Rated CVSS 9.9 with a scope change; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Feast is bundled in Red Hat OpenShift AI (RHOAI), which is the reporting vendor's affected product.

Technical ContextAI

Feast is a feature store used in MLOps pipelines to define, store, and serve machine-learning features; it persists feature definitions - including user-defined transformation functions (UDFs) - in a registry. Those UDFs are serialized with 'dill', an extension of Python's pickle that supports arbitrary code objects. Deserializing untrusted pickle/dill data is inherently dangerous because the format can invoke arbitrary callables during object reconstruction, which is the classic CWE-502 (Deserialization of Untrusted Data) root cause (the input lists CWE as N/A, so this class is inferred from the description). Because both the feature server and the registry server load these serialized UDFs, an attacker who controls a stored UDF controls code execution on whichever component deserializes it.

RemediationAI

No vendor-released patch version was included in the provided data, so upgrade to the fixed Feast / Red Hat OpenShift AI release identified in the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-18948) and Bugzilla 2511167 (https://bugzilla.redhat.com/show_bug.cgi?id=2511167) once you confirm the exact patched version there - do not rely on an invented version number. As compensating controls until patched: restrict network access to the Feast feature server and registry server so that only trusted, authenticated clients can reach the UDF storage and serving endpoints (trade-off: may break legitimate remote feature-serving clients); disable or block the ability for untrusted tenants to register or update UDFs in the registry (trade-off: prevents pushing new transformations, disrupting model pipelines); and enforce strict tenant isolation and authorization on the registry to limit the cross-tenant blast radius (trade-off: added operational overhead). Because the flaw is unsafe dill/pickle deserialization, network segmentation and write-access restriction to the registry are the highest-value stopgaps.