CVE-2026-18948

Name of the Vulnerable Software and Affected Versions Feast (affected versions not specified)

Description Improper deserialization of user-defined functions (UDFs) stored in the registry, which are serialized using the dill library, allows for arbitrary code execution. In default configurations, a remote attacker can store a malicious UDF to execute code on the feature server without authentication. Additionally, an authenticated attacker can bypass authorization checks during deserialization to execute arbitrary code on the registry server. This issue may lead to lateral movement within the system and unauthorized cross-tenant data access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.