SYS::ONLINE
Wasteland.
Briefs1839
Issues23
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-18948 2026-08-10

CVE-2026-18948: Unauthenticated RCE in Feast Feature Server

"A critical (CVSS 9.9) deserialization flaw in Feast allows an attacker to store a malicious user-defined function in the registry and gain arbitrary code execution on the feature server in default configurations."

A critical (CVSS 9.9) deserialization flaw in Feast allows an attacker to store a malicious user-defined function in the registry and gain arbitrary code execution on the feature server in default configurations.

What Is It

Feast improperly deserializes user-defined functions (UDFs) stored in its registry. Those UDFs are serialized with the dill library, and the system deserializes them without adequate validation. An attacker who can store a malicious UDF can reach arbitrary code execution on the feature server under default configurations. Separately, an authenticated attacker can achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization.

Red Hat scores this at CVSS 3.1 base 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network-reachable, low complexity, no user interaction, and a scope change with high confidentiality, integrity, and availability impact.

Note the PR:L component: the scored vector assumes the attacker already holds low-level privileges, which is what keeps the base score at 9.9 rather than 10.0. Some descriptions of this flaw characterize the feature-server path as unauthenticated; that framing is not consistent with the scored vector, and the privilege actually required will depend on how the registry and feature server are exposed in a given deployment. Treat any account that can write UDFs to the registry as sufficient for exploitation until Red Hat clarifies.

Why It Matters

The scope-changed rating is the important detail: code execution does not stop at the compromised component. Per the advisory, exploitation can result in cross-tenant data access and lateral movement within the system. In a shared ML platform, that suggests one tenant's poisoned feature definition could become a foothold against other tenants' data and workloads, though whether it does in practice depends on how the deployment isolates tenants and what the feature server's service account is permitted to reach.

There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time.

What's Vulnerable

Red Hat lists Red Hat OpenShift AI (RHOAI) as affected (cpe:/a:redhat:openshift_ai), with a default status of affected across these packages:

Patch Status

The record was published 2026-08-10 with a status of Received, and the supplied data lists no fixed versions, mitigations, or required-action deadline. Track the Red Hat CVE page and Bugzilla entry below for remediation guidance as it lands.

Sources