EUVD-2026-81050
GHSA-4rxv-8f9g-9h5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Feast feature server API
-
DeliveryCraft JWT with hardcoded claim value
-
ExploitServer skips signature verification
-
ExecutionAssume trusted internal identity, bypass RBAC
-
ImpactRead/modify all entities, feature views, and permission policies
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Feast feature server (feast-dev/feast, versions through 0.66.0) be deployed with OIDC-based authentication and RBAC authorization enabled - the vulnerability is a bypass of that RBAC layer via the OIDC token parser, so an instance running with no auth has nothing to bypass and one with a properly verified auth path is the intended state. Given that prerequisite, no further conditions apply: the attack is remote, unauthenticated (PR:N), needs no user interaction (UI:N), and works against auth-enabled default configurations because the server accepts a forged JWT bearing the hardcoded claim value without any signature check. The primary limiting factor is therefore whether the operator has turned on Feast's OIDC/RBAC authorization at all; network reachability of the feature server API is the only other precondition. |
| Impact | This is a genuine high-priority issue, not a high-CVSS-but-low-risk paper cut. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) describes an unauthenticated, network-reachable, low-complexity authentication bypass yielding full confidentiality, integrity, and availability impact - and the description supports every one of those metrics: an attacker crafts a JWT with a hardcoded claim value, the server never verifies the signature, and the attacker inherits a trusted internal identity with unchecked read/write over all Feast objects and permission policies. My independent CVSS 3.1 assessment is ~9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), consistent with the vendor. On exploitation-likelihood signals the picture is thinner: there is no CISA KEV listing, no public POC, and no EPSS score in the input, so real-world exploitation is unproven - no SSVC exploitation/automatable data was provided either. The key nuance/caveat: this only bites deployments that actually enable Feast's OIDC authentication/RBAC (authorization is opt-in), so the blast radius is limited to the subset of Feast operators who turned auth on - but for those, a trivially forgeable token equals full compromise, and the flaw is highly automatable given a static crafted token works against default auth-enabled configs. Note also a CWE nuance: the CVE assigns CWE-798 (hardcoded credentials) but the described root cause - accepting a JWT without verifying its signature - is more precisely CWE-347 (improper verification of cryptographic signature); this labeling discrepancy does not change the risk. |
| Exploit ScenarioDerived | An attacker who can reach the Feast feature server over the network crafts a JWT containing the known hardcoded claim value and presents it to the API; because signatures are never verified, the server accepts it as a trusted internal identity and grants full read/write to every entity, feature view, data source, and permission policy. No POC is public and the CVE is not in CISA KEV, but the attack requires no authentication, no user interaction, and low complexity, making it straightforward to automate against any auth-enabled instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Remote unauthenticated attackers can bypass all role-based access control on Feast feature servers (feast-dev/feast) through version 0.66.0 by presenting a forged JWT that the OIDC token parser accepts without verifying its signature, granting the attacker a trusted internal identity and unchecked read and write access to entities, feature views, data sources, and permission policies. Exploitation requires the server to be deployed with OIDC authentication and RBAC authorization enabled; an instance running with no authentication has nothing to bypass, and a properly verifying token path is the intended state. No public exploit code has been identified at time of analysis, but the issue is high priority because a network-reachable, unauthenticated attacker can obtain complete loss of confidentiality, integrity, and availability of the server's data.
RemediationAI
No vendor-released patch has been identified at time of analysis, so operators cannot yet upgrade to a fixed version; the tracking issue at https://github.com/feast-dev/feast/issues/6785 and the advisory at https://www.vulncheck.com/advisories/feast-through-0.66.0-authentication-bypass-via-unverified-token should be monitored for a release. Until a patch is available, the most effective compensating control is to place the Feast feature server behind an authenticating reverse proxy or API gateway that independently verifies JWT signatures and rejects any token containing the hard-coded claim value before requests reach Feast, with the trade-off of added architectural complexity and the need to keep the proxy's verification logic aligned with Feast's expected claims. Additionally, restrict network reachability of the feature server API to trusted networks or service meshes using firewall rules, Kubernetes NetworkPolicies, or mTLS, accepting that this limits legitimate remote clients. Disabling OIDC/RBAC entirely would remove the bypass but also eliminates all access control and is only acceptable if the server is otherwise fully isolated and unexposed. Finally, log and alert on tokens bearing the hard-coded claim or on anomalous read/write bursts against entities, feature views, data sources, and permission policies so that exploitation attempts are detected while remediation is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Feast is an open-source feature store, and its Python SDK includes an authorization layer (sdk/python/feast/permissions/security_manager.py) that relies on an OIDC token parser (sdk/python/feast/permissions/auth/oidc_token_parser.py) to derive user identity from JSON Web Tokens. The parser fails to cryptographically verify the JWT signature and instead trusts a hard-coded claim value, which maps directly to CWE-798 (Use of Hard-coded Credentials): the trusted identity is effectively baked into the code rather than derived from a verified token. Because identity is established before RBAC decisions are made, an attacker who supplies an unsigned or arbitrarily signed token containing that claim is treated as an internal trusted user, and all downstream permission checks on entities, feature views, data sources, and permission policies are evaluated against that false identity. The referenced code locations (oidc_token_parser.py lines 152-156, security_manager.py lines 248-264, and the feature-server deployment template lines 46-47) point to the token-to-identity conversion and the deployment configuration that wires in the OIDC/RBAC path, which is the prerequisite for exploitation.
Know when Feast gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network attacker forges a token accepted without signature verification (PR:N/AC:L), gaining full read/write over all server objects and policies, so C:H/I:H/A:H; scope unchanged as impact stays within the feature server.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.
Articles & Coverage 1
Executive ViewAI
A critical flaw in the open-source Feast feature server (feast-dev/feast) version 0.66.0 allows a network-reachable attacker to bypass all role-based access control by presenting a forged JWT, gaining read and write access to the feature store's entities, feature views, data sources, and permission policies. The exposure is conditional on deployments that have both OIDC authentication and RBAC authorization enabled, but for those environments the flaw can result in complete loss of confidentiality, integrity, and availability of the data the platform serves. Leadership should care because the feature store often brokers the training and serving data that downstream models and business decisions depend on, so tampering or exfiltration there can propagate silently into production analytics and machine-learning outputs.
No vendor-released patch identified at time of analysis. Interim mitigations: force JWT signature validation at an upstream API gateway or reverse proxy so forged tokens never reach Feast's OIDC parser; restrict network access to the feature server through segmentation, allow-listing, or mutual TLS so only trusted clients can connect; rotate OIDC signing keys and credentials held by the server; review and restrict the permissions attached to the trusted identity the parser would grant; and monitor logs for anomalous read or write activity against entities, feature views, data sources, and permission policies. Deployments without OIDC authentication and RBAC authorization enabled are not exposed to this specific bypass.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Feast (the open-source ML feature store) before 0.63.0 lets remote attackers run OS commands as
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
Code execution with access to GCP, AWS, and Snowflake credentials is possible in Feast's own CI pipeline prior to versio
Denial of service in the Feast Feature Server (the Python feature-store serving component, also shipped within Red Hat O
Exploit-DB