CVE-2026-18942 Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

CVE-2026-18942

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

CVE-2026-18947

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the featureviews field, an attacker can bypass intended permission checks. This allows an unauthenticated remote...

CVE-2026-18942

The CVE-2026-18942 entry concerns the Feast operator. A malicious tenant could inject arbitrary code into their feature repository, and that code could be executed by an automated process with elevated privileges. This could lead to credentials theft and direct escalation of privileges, potential...

EUVD-2026-55816

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

CVE-2026-18941 Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

EUVD-2026-55815

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

CVE-2026-18942

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

CVE-2026-18941

Feast and feast-operator expose a vulnerability due to default no_auth configuration, allowing unauthenticated access to feature-server, registry-server, and offline-server endpoints. The root cause is missing authentication, enabling a remote attacker to store a malicious User-Defined Function (...

CVE-2026-18941 Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

CVE-2026-18941

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

CVE-2026-18941

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

cbtham-feast-az-provider (0.2.299), elemeno-ai-sdk (>=0.0.5, <=0.6.11) +26 more potentially affected by CVE-2026-18947 via feast (>=0.9.3, <=0.66.0)

feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.1.0, =0.3.0, =0.1.1, =0.1.0rc3, =0.0.2, =1.0.0, =1.0.0, =0.1.0, =0.4.0 and more Source cves: CVE-2026-18947 Source advisory: SNYK:PYTHON-FEAST-18612610...

cbtham-feast-az-provider (0.2.299), elemeno-ai-sdk (>=0.0.5, <=0.6.11) +26 more potentially affected by CVE-2026-18948 via feast (>=0.9.3, <=0.66.0)

feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.1.0, =0.3.0, =0.1.1, =0.1.0rc3, =0.0.2, =1.0.0, =1.0.0, =0.1.0, =0.4.0 and more Source cves: CVE-2026-18948 Source advisory: SNYK:PYTHON-FEAST-18612609...

Missing Authentication for Critical Function

Overview feast is a Python SDK for Feast Affected versions of this package are vulnerable to Missing Authentication for Critical Function through the feature-server, registry-server, and offline-server endpoints when the default noauth configuration leaves no security manager installed. An attack...

cbtham-feast-az-provider (0.2.299), elemeno-ai-sdk (>=0.0.5, <=0.6.11) +26 more potentially affected by CVE-2026-18941 via feast (>=0.9.3, <=0.66.0)

feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.1.0, =0.3.0, =0.1.1, =0.1.0rc3, =0.0.2, =1.0.0, =1.0.0, =0.1.0, =0.4.0 and more Source cves: CVE-2026-18941 Source advisory: SNYK:PYTHON-FEAST-18612620...

cbtham-feast-az-provider (0.2.299), elemeno-ai-sdk (>=0.0.5, <=0.6.11) +25 more potentially affected by CVE-2026-18941 via feast (>=0.9.3, <=0.65.0)

feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.1.0, =0.3.0, =0.1.1, =0.1.0rc3, =0.0.2, =1.0.0, =1.0.0, =0.1.0, =0.4.0 - mlops-ods 0.1.202406281646 and more Source cves: CVE-2026-18941 Source advisory: SNYK:PYTHON-FEAST-18612620...

PT-2026-69962

Name of the Vulnerable Software and Affected Versions Feast operator affected versions not specified Description A flaw allows a malicious tenant to inject arbitrary code into their feature repository. This code is executed by an automated process with elevated privileges, enabling the tenant to...

PT-2026-69963

Name of the Vulnerable Software and Affected Versions Feast affected versions not specified Description An authorization bypass exists in the '/materialize' and '/materialize-incremental' endpoints. By sending a specially crafted request that omits the feature views field, an unauthenticated remo...

PT-2026-69961

Name of the Vulnerable Software and Affected Versions Feast affected versions not specified feast-operator affected versions not specified Description Feast and feast-operator use a default configuration of "no auth", which means no security manager is installed. This allows unauthenticated and...