CVE-2026-18947

Name of the Vulnerable Software and Affected Versions Feast (affected versions not specified)

Description An authorization bypass exists in the '/materialize' and '/materialize-incremental' endpoints. By sending a specially crafted request that omits the feature views field, an unauthenticated remote attacker or any authenticated user can bypass permission checks. This allows the attacker to trigger a full re-materialization of all feature views, leading to a Denial of Service (DoS) caused by data corruption and significant resource consumption across all tenants.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.