PT-2026-51837 · Feast Dev · Feast

Tanguy Snoeck · Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-56121

Mitre

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user defined function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary reduce method to execute OS commands as the feast service account.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2026-56121

Produtos afetados

Feast

Referências · 5

• 🔥 https://huntr.com/bounties/d64b8111-180b-46ba-afa3-c877fda2ede6 · Exploit
• https://github.com/feast-dev/feast/commit/835cda8e2c1359f1f496ad72701dbd6a73bdb25a · Correção
• https://github.com/feast-dev/feast/releases/tag/v0.63.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56121 · Nota de Segurança
• https://vulncheck.com/advisories/feast-unauthenticated-rce-via-applyfeatureview-grpc-deserialization · Nota