CVE-2026-23536: Feast Feature Server File Disclosure Flaw

CVE-2026-23536 Overview

A security issue was discovered in the Feast Feature Server's /read-document endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to potentially retrieve sensitive system files, application configurations, and credentials.

This path traversal vulnerability (CWE-22) exposes organizations running Feast Feature Server to significant data exposure risks, as attackers can remotely access arbitrary files without authentication.

Critical Impact

Unauthenticated attackers can read sensitive files including system configurations, credentials, and application secrets by exploiting the /read-document endpoint.

Affected Products

• Feast Feature Server (specific versions not disclosed)

Discovery Timeline

• 2026-03-20 - CVE-2026-23536 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-23536

Vulnerability Analysis

This path traversal vulnerability exists in the Feast Feature Server's /read-document endpoint. The endpoint fails to properly validate and sanitize user-supplied file path input, allowing attackers to use directory traversal sequences to escape the intended directory structure and access arbitrary files on the underlying system.

The vulnerability requires no authentication, meaning any network-accessible instance of the Feast Feature Server is potentially exploitable. The impact is limited to confidentiality—attackers can read files but cannot modify them or cause service disruption through this specific vulnerability.

Root Cause

The root cause of CVE-2026-23536 is improper input validation (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). The /read-document endpoint does not adequately sanitize file path parameters, allowing directory traversal sequences such as ../ to be processed. This enables attackers to navigate outside the intended document root and access files anywhere on the filesystem that the server process has read permissions for.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker sends a crafted HTTP POST request to the /read-document endpoint with a malicious file path containing directory traversal sequences. The server processes this request and returns the contents of the specified file.

The vulnerability is particularly dangerous in containerized deployments where configuration files, environment variables, and secrets may be accessible to the server process. Common targets include:

• /etc/passwd - System user information
• Application configuration files containing database credentials
• Environment files with API keys and secrets
• Cloud provider metadata endpoints and credentials

Detection Methods for CVE-2026-23536

Indicators of Compromise

• HTTP POST requests to /read-document endpoint containing ../ or URL-encoded variants (%2e%2e%2f)
• Unusual access patterns to the /read-document endpoint from external IP addresses
• Server logs showing requests for system files like /etc/passwd, /etc/shadow, or credential files
• Requests with path parameters containing absolute file paths (e.g., /etc/, /var/, /home/)

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block directory traversal patterns in request parameters
• Monitor application logs for unusual file access attempts through the /read-document endpoint
• Deploy intrusion detection systems (IDS) with signatures for path traversal attack patterns
• Set up alerts for any access to the /read-document endpoint from untrusted network segments

Monitoring Recommendations

• Enable detailed logging on the Feast Feature Server to capture all requests to the /read-document endpoint
• Configure SIEM rules to correlate multiple failed file access attempts from the same source
• Implement file integrity monitoring on sensitive system files to detect unauthorized reads
• Monitor network traffic for large data exfiltration following requests to the vulnerable endpoint

How to Mitigate CVE-2026-23536

Immediate Actions Required

• Restrict network access to the Feast Feature Server to trusted IP ranges or internal networks only
• Implement authentication on the Feature Server if not already configured
• Deploy a reverse proxy or WAF in front of the service with path traversal filtering enabled
• Review server logs for evidence of exploitation attempts

Patch Information

Consult the Red Hat CVE Advisory and Red Hat Bug Report #2429302 for the latest patch information and updated package versions. Apply vendor-supplied patches as they become available.

Workarounds

• Disable or restrict access to the /read-document endpoint if it is not required for operations
• Implement network segmentation to limit exposure of the Feast Feature Server to untrusted networks
• Use container security policies to restrict file system access for the server process
• Deploy application-level input validation as a compensating control until patches are available

# Example: Restrict access to the endpoint using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP