CVE-2026-18947: Feast Authorization Bypass Vulnerability

CVE-2026-18947 Overview

CVE-2026-18947 is an authorization bypass vulnerability in Feast, an open-source feature store for machine learning. The flaw affects the /materialize and /materialize-incremental endpoints. Attackers can bypass permission checks by sending a crafted request that omits the feature_views field. Successful exploitation triggers a full re-materialization of all feature views across every tenant. The resulting data corruption and resource consumption produce a Denial of Service (DoS) condition. The weakness is tracked as [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated or low-privileged remote attackers can force a cross-tenant re-materialization of all feature views, corrupting data and exhausting resources across the Feast deployment.

Affected Products

Feast (open-source feature store)
Red Hat OpenShift AI distributions bundling Feast (see RHSA-2026:53261)
Red Hat OpenShift AI distributions bundling Feast (see RHSA-2026:53263)

Discovery Timeline

2026-08-10 - CVE-2026-18947 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18947

Vulnerability Analysis

Feast exposes HTTP endpoints that trigger materialization jobs, which read data from offline stores and write feature values into online stores. The /materialize and /materialize-incremental endpoints enforce authorization by inspecting the feature_views field in the incoming request. Requests reference specific feature views, and the server validates the caller's permissions against those objects.

When the feature_views field is omitted, the authorization logic fails to enumerate any target objects. Rather than rejecting the request, Feast falls back to processing all registered feature views. The permission gate is skipped entirely because there are no per-object checks to run. Any authenticated user, and in some deployments an unauthenticated remote attacker, can invoke this code path.

Root Cause

The root cause is missing authorization at the endpoint boundary [CWE-862]. Access control is implemented as a per-object filter rather than a mandatory gate. When the request payload contains no objects to filter, the check returns an empty result set and the handler proceeds with a global default. This design conflates "no targets specified" with "caller is authorized for all targets."

Attack Vector

The attack vector is network-based and requires low or no privileges depending on deployment. An attacker sends an HTTP request to the /materialize or /materialize-incremental endpoint of the Feast feature server. The request body omits the feature_views field or supplies a null value. Feast then queues a materialization job spanning every feature view in the registry.

The operation reads from every configured offline store, writes to every online store, and holds compute and I/O resources for the duration. Repeated invocations amplify the impact. Concurrent tenants sharing the deployment experience data corruption when partial writes overlap legitimate ingestion jobs.

No verified public exploit code is available. Refer to the Red Hat CVE Analysis for CVE-2026-18947 for further technical detail.

Detection Methods for CVE-2026-18947

Indicators of Compromise

HTTP POST requests to /materialize or /materialize-incremental with a missing, null, or empty feature_views field in the JSON body.
Unexpected spikes in offline-to-online store read/write throughput not tied to scheduled ingestion jobs.
Materialization job logs referencing every registered feature view within a short time window.
Repeated 200-response materialization calls originating from a single client IP or service account.

Detection Strategies

Enable request-body logging on the Feast feature server and alert on materialization calls that lack the feature_views parameter.
Correlate API gateway logs with materialization job scheduler events to identify unauthorized invocations.
Baseline normal materialization frequency per tenant and alert on deviations exceeding the baseline.

Monitoring Recommendations

Instrument the Feast feature server with structured access logs forwarded to a centralized log platform for retention and search.
Monitor CPU, memory, and storage I/O on Feast worker pods, particularly during off-hours when materialization is unexpected.
Track materialization job duration and record counts to catch full-registry runs early.

How to Mitigate CVE-2026-18947

Immediate Actions Required

Apply the fixed Feast package versions shipped in Red Hat Security Advisory RHSA-2026:53261 and Red Hat Security Advisory RHSA-2026:53263.
Restrict network access to the Feast feature server so only trusted internal clients can reach /materialize and /materialize-incremental.
Audit recent materialization job history for unauthorized full-registry runs and validate online store integrity.
Rotate any API tokens or service account credentials that could have been used to invoke the vulnerable endpoints.

Patch Information

Red Hat has published fixed packages in RHSA-2026:53261 and RHSA-2026:53263. Additional vendor detail is available in the Red Hat CVE Analysis for CVE-2026-18947 and Red Hat Bug Report #2511164. Upgrade Feast to the patched release identified by the advisory that matches your distribution channel.

Workarounds

Place the Feast feature server behind an authenticating reverse proxy that rejects materialization requests missing the feature_views field.
Disable the /materialize and /materialize-incremental endpoints at the ingress layer if materialization is triggered exclusively through offline job schedulers.
Apply per-tenant network policies in Kubernetes to prevent cross-tenant reachability to the feature server pods.

bash

# Example NGINX ingress snippet blocking materialization requests without feature_views
location ~ ^/materialize(-incremental)?$ {
    if ($request_method = POST) {
        access_by_lua_block {
            ngx.req.read_body()
            local body = ngx.req.get_body_data() or ""
            if not string.find(body, '"feature_views"') then
                ngx.exit(403)
            end
        }
    }
    proxy_pass http://feast_feature_server;
}