CVE-2026-18941: Feast: feast-operator: feast: default authentication mode is no_auth — shar

Description

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

1786110051 to < *unaffected

Red Hat Red Hat OpenShift AI 3.3

Default version status: affected

1786110033 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

1786107278 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

1791868194 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

1791833225 to < *unaffected