PT-2026-51837 · Feast · Feast

Tanguy Snoeck · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-56121

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Feast versions prior to 0.63.0

Description An unsafe deserialization issue exists in the registry server that allows unauthenticated or unauthorized attackers to achieve remote code execution. The problem occurs because the user defined function.body field of an OnDemandFeatureView spec is base64-decoded and passed to the dill.loads() function before any authorization checks are performed. Attackers can exploit this by sending a crafted gRPC request containing a malicious serialized Python object with an arbitrary reduce method to execute OS commands as the feast service account.

Recommendations Update to version 0.63.0 or newer.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-56121

Affected Products

Feast

References · 7

• 🔥 https://huntr.com/bounties/d64b8111-180b-46ba-afa3-c877fda2ede6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-56121 · Security Note
• https://github.com/feast-dev/feast/commit/835cda8e2c1359f1f496ad72701dbd6a73bdb25a · Patch
• https://vulncheck.com/advisories/feast-unauthenticated-rce-via-applyfeatureview-grpc-deserialization · Note
• https://twitter.com/UpwindMDR/status/2069834827935748491 · Twitter Post
• https://twitter.com/OrizonCyber/status/2069820357431718388 · Twitter Post
• https://github.com/feast-dev/feast/releases/tag/v0.63.0 · Note