Description
Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account.
References
- www.cve.org/CVERecord ↗
- nvd.nist.gov/vuln/detail/CVE-2026-56121 ↗
- github.com/feast-dev/feast/commit/835cda8e2c1359f1f496ad72701dbd6a73bdb25a ↗
- github.com/feast-dev/feast/releases/tag/v0.63.0 ↗
- huntr.com/bounties/d64b8111-180b-46ba-afa3-c877fda2ede6 ↗
- www.vulncheck.com/advisories/feast-unauthenticated-rce-via-applyfeatureview-grpc-deserialization ↗
- access.redhat.com/errata/RHSA-2026:60520 ↗
- access.redhat.com/security/cve/CVE-2026-56121 ↗
- bugzilla.redhat.com/show_bug.cgi ↗
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56121.json ↗
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.