Critical Arbitrary Code Execution in Feast via UDF Deserialization

CVE-2026-18948 is a critical vulnerability within the Feast feature store platform. The flaw stems from the insecure deserialization of user-defined functions (UDFs) stored within the system registry, which utilize the 'dill' Python serialization library. Because 'dill' is capable of serializing complex Python objects, including code, an attacker can craft and store a malicious UDF that executes arbitrary commands upon deserialization.

In default configurations, remote unauthenticated attackers can inject these malicious payloads to gain code execution on the feature server. Furthermore, authenticated users can exploit the same deserialization process to bypass authorization checks, potentially leading to cross-tenant data access and facilitate lateral movement across the infrastructure. This vulnerability poses a severe risk to organizations leveraging Feast for machine learning pipelines.

Impact

Successful exploitation results in full remote code execution on the feature server. An attacker can gain control of the feature store, access sensitive model data, manipulate training features to poison machine learning models, or pivot deeper into the internal network to compromise additional cloud-native assets.

Recommendation

• Immediately upgrade Feast to a patched version that replaces or secures the 'dill' deserialization implementation.
• Implement strict network segmentation around Feast registry and feature server endpoints to prevent unauthorized access.
• Review all existing UDFs stored in the registry for suspicious or unexpected code patterns.
• Audit access logs for the Feast API to identify unauthorized write operations to the registry endpoint.