by Kastro CVE-2026-56121
feast-dev feast — Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization
Description · from the CVE record
Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account.
Affected
ProductAffectedFixed inSource
feast< 0.63.00.63.0CNA
Red Hat OpenShift AI 3.4see advisory1787073866redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787073873redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787073459redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787073611redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787073451redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787073451redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787121387redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787074331redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787073605redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787073546redhat-SADP
Red Hat OpenShift AI 3.4see advisory1787073717redhat-SADP
Scores by source
VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
redhat-SADP (CNA)8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total