In default configurations, remote unauthenticated attackers can inject these malicious payloads to gain code execution on the feature server. Furthermore, authenticated users can exploit the same deserialization process to bypass authorization checks, potentially leading to cross-tenant data access and facilitate lateral movement across the infrastructure. This vulnerability poses a severe risk to organizations leveraging Feast for machine learning pipelines.

Impact

Successful exploitation results in full remote code execution on the feature server. An attacker can gain control of the feature store, access sensitive model data, manipulate training features to poison machine learning models, or pivot deeper into the internal network to compromise additional cloud-native assets.

Recommendation

• Immediately upgrade Feast to a patched version that replaces or secures the 'dill' deserialization implementation.
• Implement strict network segmentation around Feast registry and feature server endpoints to prevent unauthorized access.
• Review all existing UDFs stored in the registry for suspicious or unexpected code patterns.
• Audit access logs for the Feast API to identify unauthorized write operations to the registry endpoint.