CVE-2026-18941

Summary

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.

Affected Software

Weaknesses

• CWE-306: Missing Authentication for Critical Function

Workarounds

To mitigate this vulnerability, configure Feast deployments to utilize Kubernetes RBAC authentication. Ensure that FeatureStore Custom Resources (CRs) explicitly define an authentication mechanism other than no_auth. For Feast SDK usage, avoid the no_auth setting in production environments unless FEAST_INSECURE_NO_AUTH=1 is explicitly set, acknowledging the security implications. Applying these configuration changes will require a redeployment or restart of the affected Feast services.

References

• https://access.redhat.com/security/cve/CVE-2026-18941
• https://bugzilla.redhat.com/show_bug.cgi?id=2511116

• ←Previous
• Next→