CVE-2026-92787

Name of the Vulnerable Software and Affected Versions Feast versions prior to 0.66.0

Description The software fails to verify JSON Web Token (JWT) signatures before establishing user identity. This allows an attacker to bypass role-based access control by presenting an unverified token containing a hardcoded claim value. By doing so, an attacker can obtain a trusted internal identity, granting unauthorized read and write access to all entities, feature views, data sources, and permission policies on the server.

Recommendations Update to version 0.66.0 or later.