Description
A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat OpenShift AI 2.25
Default version status: affected
1786110051 to < *unaffected
Red Hat Red Hat OpenShift AI 3.3
Default version status: affected
1786110033 to < *unaffected
Red Hat Red Hat OpenShift AI 3.4
Default version status: affected
1791863220 to < *unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected