Executive brief
Feast, an open-source feature store used for machine learning, is vulnerable to a critical security flaw in its registry server. An unauthenticated attacker can send a specially crafted network request that forces the system to execute malicious code. This could allow an attacker to take full control of the server, access sensitive machine learning data, or disrupt operations.
Technical details
An unsafe deserialization vulnerability exists in Feast's registry server due to the use of 'dill.loads()' on untrusted input. Specifically, the 'user_defined_function.body' field within an 'OnDemandFeatureView' specification is decoded from base64 and deserialized before any authorization checks are performed. A remote, unauthenticated attacker can exploit this by sending a crafted gRPC request containing a malicious Python object with a custom '__reduce__' method. Successful exploitation allows for arbitrary OS command execution under the context of the Feast service account. This issue is resolved in version 0.63.0.
Affected products
- Feast Dev Feast < 0.63.0
Timeline
- 2026-04-22: patched: Fix commit 835cda8 merged into master
- 2026-05-04: advisory: Version 0.63.0 released
- 2026-06-24: disclosed: CVE published and NVD record created
References
- https://github.com/feast-dev/feast/commit/835cda8e2c1359f1f496ad72701dbd6a73bdb25a
- https://github.com/feast-dev/feast/releases/tag/v0.63.0
- https://huntr.com/bounties/d64b8111-180b-46ba-afa3-c877fda2ede6
- https://www.vulncheck.com/advisories/feast-unauthenticated-rce-via-applyfeatureview-grpc-deserialization