Attack Chain

1. An attacker identifies a publicly accessible instance of the Feast Feature Server running a vulnerable version (prior to 0.59.0).
2. The attacker initiates a large number of unauthenticated WebSocket handshake requests targeting the /ws/chat endpoint on the vulnerable server.
3. The Feast Feature Server, due to the vulnerability, establishes and maintains these persistent WebSocket connections without requiring any form of authentication.
4. The continuous establishment and maintenance of numerous unauthenticated connections rapidly consume the server's available resources, such as memory and CPU cycles.
5. The server also exhausts its capacity for file descriptors, which are required for each open connection.
6. As critical resources become depleted, the Feast Feature Server becomes unresponsive to legitimate requests, resulting in a complete denial of service.

Impact

Successful exploitation of CVE-2026-23538 leads to a complete denial of service for the Feast Feature Server. This means legitimate users will be unable to access feature data, disrupting critical applications and services that rely on the server. The attack exhausts server resources such as memory, CPU, and file descriptors, rendering the server inoperable. While no specific victim numbers or targeted sectors are detailed in the advisory, any organization utilizing vulnerable versions of the Feast Feature Server, especially those integrated into platforms like Red Hat OpenShift AI, is at risk of severe operational disruption and potential data pipeline failures.

Recommendation

• Patch CVE-2026-23538 immediately by upgrading Feast Feature Server to version 0.59.0 or later to mitigate the vulnerability.
• Deploy the Sigma rule "Detect Unauthenticated WebSocket Connection Attempts to Feast Feature Server '/ws/chat' Endpoint" to your SIEM and investigate any alerts, especially in conjunction with unusually high connection rates or resource utilization on Feast servers.
• Implement network-level rate limiting or connection throttling for ingress traffic targeting the Feast Feature Server's /ws/chat endpoint to prevent resource exhaustion attacks.
• Monitor webserver logs for a high volume of connections to /ws/chat from single or multiple IP addresses, particularly without expected authentication headers.