7.7

CVE-2026-18941

Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 2.25
Default Statusaffected
Version 1786110051
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.3
Default Statusaffected
Version 1786110033
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.4
Default Statusaffected
Version 1786107278
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI (RHOAI)
Default Statusaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.451
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 7.7 3.1 4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://access.redhat.com/security/cve/CVE-2026-18941
https://bugzilla.redhat.com/show_bug.cgi?id=2511116
https://access.redhat.com/errata/RHSA-2026:53263
https://access.redhat.com/errata/RHSA-2026:53261
https://access.redhat.com/errata/RHSA-2026:53262