Skip to content
Threat Feed
Subscribe

Vendor

Feast

3 briefs RSS
high advisory

Unauthenticated RCE and Data Access in Feast via Default Configuration

Feast and feast-operator contain a vulnerability due to a default 'no_auth' configuration, allowing unauthenticated attackers to achieve RCE via malicious User-Defined Functions and perform unauthorized cross-tenant data access.

Feast SDK +1 vulnerability rce authentication-bypass
3t 1c
critical advisory

Critical Arbitrary Code Execution in Feast via UDF Deserialization

Feast improperly deserializes user-defined functions via the 'dill' library, allowing remote unauthenticated attackers to achieve arbitrary code execution on feature servers.

Feast
1r 4t 1c
low advisory

Feast Feature Server Denial of Service via Unauthenticated WebSocket Connections (CVE-2026-23538)

A vulnerability (CVE-2026-23538) exists in the Feast Feature Server's /ws/chat endpoint, allowing remote attackers to establish numerous unauthenticated, persistent WebSocket connections. This exploit, a form of resource exhaustion (CWE-770), consumes server resources like memory, CPU, and file descriptors, leading to a complete denial of service for legitimate users. Affected versions are those prior to 0.59.0.

Feast Feature Server +1 denial-of-service vulnerability websocket resource-exhaustion feast-feature-server
1r 1t 1c