Feast Feature Server <=0.58.0 - Arbitrary File Read

Feast the open-source Feature Store Feature Server through 0.58.0 exposes an unauthenticated POST /read-document endpoint that reads an arbitrary, caller-supplied file path with no authentication and no path validation. The readdocumentendpoint handler passes the JSON filepath field straight to...

EUVD-2026-13816

A security issue was discovered in the Feast Feature Server's /read-document endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to...

CVE-2026-23536

A security issue was discovered in the Feast Feature Server's /read-document endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to...

CVE-2026-23536 Feast: unauthenticated arbitrary file read

A security issue was discovered in the Feast Feature Server's /read-document endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to...

CVE-2026-23536 Feast: unauthenticated arbitrary file read

A security issue was discovered in the Feast Feature Server's /read-document endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to...

CVE-2026-23536

The Feast Feature Server (versions through 0.58.0 ) is vulnerable to an unauthenticated arbitrary file read vulnerability via the /read-document endpoint. The root cause is a lack of path validation, where the handler passes the JSON file_path field directly to os.path.exists() and open(). This a...

CVE-2026-23536

A security issue was discovered in the Feast Feature Server's /read-document endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to...

CVE-2026-23536

A security issue was discovered in the Feast Feature Server's /read-document endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to...

Directory Traversal

Overview feast is a Python SDK for Feast Affected versions of this package are vulnerable to Directory Traversal via the /read-document endpoint. An attacker can access arbitrary files accessible to the server process by sending a crafted HTTP POST request. Details A Directory Traversal attack al...

PT-2026-26683

Name of the Vulnerable Software and Affected Versions Feast Feature Server affected versions not specified Description A security issue exists in the Feast Feature Server that allows an unauthenticated remote attacker to read any file accessible to the server process. This is exploitable through...