CVE-2026-18941

HighCVSS 7.7/10Last modified Oct 19, 2026

Description

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 10, 2026
Last modified
Oct 19, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-189425.5A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be exeCVE-2026-189436.5The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a rolCVE-2026-189458.2The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when CVE-2026-189467.5The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms iCVE-2026-189478.5A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sendiCVE-2026-189489.9A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized usiCVE-2026-189498.8A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, toCVE-2026-18956.3A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment StCVE-2026-189508.8A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are createCVE-2026-189518.8A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs`CVE-2026-189528.1Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remCVE-2026-189538.8Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 throug