Feast
Monthly
Code execution with access to GCP, AWS, and Snowflake credentials is possible in Feast's own CI pipeline prior to version 0.65.0, because the pr_integration_tests.yml workflow uses pull_request_target together with the synchronize event and preserves ok-to-test, approved, or lgtm labels on newly pushed commits. A fork contributor can get maintainer approval for a benign revision and then push altered commits that are checked out from refs/pull/${{ github.event.pull_request.number }}/merge and run through privileged make targets, resulting in runner code execution, credential disclosure, and possible access to downstream cloud resources; the CVSS vector indicates the attacker needs only a low-privilege GitHub identity (PR:L) plus a maintainer's approval action (UI:P), and no public exploit code was identified at the time of analysis. This is a CI/CD pipeline misconfiguration in the upstream feast-dev/feast repository rather than a flaw in deployed Feast installations, and it is fixed in 0.65.0.
Remote unauthenticated attackers can bypass all role-based access control on Feast feature servers (feast-dev/feast) through version 0.66.0 by presenting a forged JWT that the OIDC token parser accepts without verifying its signature, granting the attacker a trusted internal identity and unchecked read and write access to entities, feature views, data sources, and permission policies. Exploitation requires the server to be deployed with OIDC authentication and RBAC authorization enabled; an instance running with no authentication has nothing to bypass, and a properly verifying token path is the intended state. No public exploit code has been identified at time of analysis, but the issue is high priority because a network-reachable, unauthenticated attacker can obtain complete loss of confidentiality, integrity, and availability of the server's data.
Denial of service in the Feast Feature Server (the Python feature-store serving component, also shipped within Red Hat OpenShift AI/RHOAI) lets remote unauthenticated attackers exhaust host resources through its `/ws/chat` WebSocket endpoint. Because the endpoint accepts unlimited concurrent connections and unbounded message traffic, opening many simultaneous sockets drains memory, CPU, and file descriptors until legitimate clients are locked out. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; the upstream fix in PR #192 caps connections, message size, and message rate.
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker write attacker-controlled JSON to the host filesystem, bypassing the endpoint's path restrictions to overwrite application configuration or startup scripts. Because no credentials are required (CVSS 9.1, PR:N), any network-reachable attacker can corrupt system integrity, cause denial of service through disk exhaustion, or potentially achieve remote code execution. This flaw also ships in Red Hat OpenShift AI (RHOAI), which bundles Feast; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution in Feast (the open-source ML feature store) before 0.63.0 lets remote attackers run OS commands as the feast service account by sending a crafted ApplyFeatureView gRPC request to the registry server. The registry base64-decodes the user_defined_function.body field of an OnDemandFeatureView and passes it to dill.loads() before any authorization check, so no credentials are required. A publicly available exploit code exists (reported by VulnCheck via huntr) and a vendor patch is available, though the flaw is not listed in CISA KEV.
Code execution with access to GCP, AWS, and Snowflake credentials is possible in Feast's own CI pipeline prior to version 0.65.0, because the pr_integration_tests.yml workflow uses pull_request_target together with the synchronize event and preserves ok-to-test, approved, or lgtm labels on newly pushed commits. A fork contributor can get maintainer approval for a benign revision and then push altered commits that are checked out from refs/pull/${{ github.event.pull_request.number }}/merge and run through privileged make targets, resulting in runner code execution, credential disclosure, and possible access to downstream cloud resources; the CVSS vector indicates the attacker needs only a low-privilege GitHub identity (PR:L) plus a maintainer's approval action (UI:P), and no public exploit code was identified at the time of analysis. This is a CI/CD pipeline misconfiguration in the upstream feast-dev/feast repository rather than a flaw in deployed Feast installations, and it is fixed in 0.65.0.
Remote unauthenticated attackers can bypass all role-based access control on Feast feature servers (feast-dev/feast) through version 0.66.0 by presenting a forged JWT that the OIDC token parser accepts without verifying its signature, granting the attacker a trusted internal identity and unchecked read and write access to entities, feature views, data sources, and permission policies. Exploitation requires the server to be deployed with OIDC authentication and RBAC authorization enabled; an instance running with no authentication has nothing to bypass, and a properly verifying token path is the intended state. No public exploit code has been identified at time of analysis, but the issue is high priority because a network-reachable, unauthenticated attacker can obtain complete loss of confidentiality, integrity, and availability of the server's data.
Denial of service in the Feast Feature Server (the Python feature-store serving component, also shipped within Red Hat OpenShift AI/RHOAI) lets remote unauthenticated attackers exhaust host resources through its `/ws/chat` WebSocket endpoint. Because the endpoint accepts unlimited concurrent connections and unbounded message traffic, opening many simultaneous sockets drains memory, CPU, and file descriptors until legitimate clients are locked out. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; the upstream fix in PR #192 caps connections, message size, and message rate.
Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker write attacker-controlled JSON to the host filesystem, bypassing the endpoint's path restrictions to overwrite application configuration or startup scripts. Because no credentials are required (CVSS 9.1, PR:N), any network-reachable attacker can corrupt system integrity, cause denial of service through disk exhaustion, or potentially achieve remote code execution. This flaw also ships in Red Hat OpenShift AI (RHOAI), which bundles Feast; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution in Feast (the open-source ML feature store) before 0.63.0 lets remote attackers run OS commands as the feast service account by sending a crafted ApplyFeatureView gRPC request to the registry server. The registry base64-decodes the user_defined_function.body field of an OnDemandFeatureView and passes it to dill.loads() before any authorization check, so no credentials are required. A publicly available exploit code exists (reported by VulnCheck via huntr) and a vendor patch is available, though the flaw is not listed in CISA KEV.