← CVE Intelligence

CVE-2026-18948

Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server PUBLISHED

Description (CNA)

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat OpenShift AI 2.25unaffected 1786110051 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1786110033 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1786107278 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1787068065 before *
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected

CWE

CWE-502

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.