TI-2026-40104 CVE-2026-55563
Incorrect authorization in feast-dev feast
Priority HIGH 74
Feast is the open source feature store for AI and machine learning.
Vulnerabilities
5 records
TI-2026-62528 CVE-2026-92787 · GHSA-4rxv-8f9g-9h5w
Feast through 0.66.0 Authentication Bypass via Unverified Token
Priority HIGH 81
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value.
TI-2026-40500 CVE-2026-56121 · GHSA-q63x-9pfm-mjx4
Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization
Priority HIGH 81
Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server.
TI-2025-10223 CVE-2025-11157 · GHSA-34wm-4hw7-qfjv
Arbitrary Code Execution in feast-dev/feast
Priority HIGH 69
A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py`.
TI-2024-10749 CVE-2024-11602 · GHSA-wxpc-2674-rxvw
CORS Vulnerability in feast-dev/feast
Priority HIGH 66
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0.