CVE-2026-18947

Awaiting Analysis Awaiting Analysis - Queue

Feast Authorization Bypass Leads to DoS

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: redhat-SADP

Description

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-31

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-29

NVD

CVE-2026-18947

Affected Vendors & Products

Vendor	Product	Version / Range
feast	feast	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass flaw in Feast. It allows attackers to bypass permission checks by sending a crafted request that omits the feature_views field. This enables unauthenticated remote attackers or authenticated users to trigger a full re-materialization of all feature views, causing a Denial of Service due to data corruption and high resource usage.

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to /materialize or /materialize-incremental endpoints that omit the feature_views field. Check logs for repeated requests triggering re-materialization. Use tools like curl to test endpoints for unauthorized access. Example: curl -X POST http://<target>/materialize -H 'Content-Type: application/json' -d '{}'

Impact Analysis

The impact includes service disruption due to Denial of Service, data corruption from re-materialization, and excessive resource consumption affecting all tenants. Attackers could exploit this to degrade system performance or crash services.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data through the authorization bypass. The DoS condition may also lead to data corruption or unavailability, violating integrity and availability requirements under these regulations.

Mitigation Strategies

Immediately restrict access to the /materialize and /materialize-incremental endpoints in Feast. Ensure all requests include the feature_views field to enforce permission checks. Monitor network traffic for unusual requests omitting this field.

Hi! I’m here to help you understand CVE-2026-18947. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70