CVE-2026-18941

Name of the Vulnerable Software and Affected Versions Feast (affected versions not specified) feast-operator (affected versions not specified)

Description Feast and feast-operator use a default configuration of "no auth", which means no security manager is installed. This allows unauthenticated and unauthorized access to the 'feature-server', 'registry-server', and 'offline-server' endpoints. A remote attacker can exploit this lack of authentication to achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the 'feature-server', cause a denial of service (DoS) by forcing the re-materialization of all tenant features, or gain unauthorized access to data across different tenants.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.