{"id":"CVE-2026-18948","kind":"vulnerability","aliases":["CVE-2026-18948","GHSA-gg2p-37pv-v7fq"],"related":[],"title":"Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs","description":"A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.","summary":"Feast, a Python feature store, deserializes user-defined functions stored in its registry using the dill library without safe checks. A remote attacker can store a malicious UDF and get arbitrary code execution on the feature server, and an authenticated user can do the same on the registry server.","severity":"critical","cvss":9.9,"epss":0.01079,"exploited":false,"exploited_at":null,"products":[{"name":"feast","fixed":["0.67.0"],"affected":"< 0.67.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-502","feast","feature-store","package","python","self-hosted"],"not_affected_if":["fixed-version-0.67.0"],"how_to_check":"- Check the installed Feast version with `pip show feast` and compare it with the affected range below.\n- Look for a feature server or registry server running a Feast version below `0.67.0`.\n- Confirm whether the registry accepts UDFs from untrusted users, since the sources say exposure is default-config.","fix":"- Upgrade feast to `0.67.0` or later.","status":"open","published_at":"2026-08-10T21:17:21+00:00","first_seen_at":"2026-11-03T16:25:28+00:00","triaged_at":"2026-11-03T16:25:42+00:00","updated_at":"2026-11-03T16:51:48+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T16:25:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade feast to `0.67.0` or later.","reach":"internet","title":"Feast: unsafe dill deserialization lets remote attackers run code","impact":"high","summary":"Feast, a Python feature store, deserializes user-defined functions stored in its registry using the dill library without safe checks. A remote attacker can store a malicious UDF and get arbitrary code execution on the feature server, and an authenticated user can do the same on the registry server.","audience":"developers","category":"package","nicknames":[],"who_cares":["feast","python","feature-store","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the feature and registry servers","analyst_note":"Confirm the exact default-config exposure and the registry authorization bypass details at https://github.com/advisories/GHSA-gg2p-37pv-v7fq.","how_to_check":"- Check the installed Feast version with `pip show feast` and compare it with the affected range below.\n- Look for a feature server or registry server running a Feast version below `0.67.0`.\n- Confirm whether the registry accepts UDFs from untrusted users, since the sources say exposure is default-config.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version-0.67.0"],"who_is_affected":"Teams running a Feast feature server or registry that is on a version before `0.67.0`. The sources say the feature server is exploitable unauthenticated in default configurations, so any reachable deployment should be treated as exposed. Teams that do not run Feast servers in production, or that have already moved to `0.67.0` or later, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000736,"input_tokens":4285,"output_tokens":614,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-18948':17A,25A '-2026':16A,24A '-502':28B '37pv':21A 'access':165C 'achiev':142C 'allow':115C 'also':141C 'arbitrari':4A,69B,127C,143C 'attack':61B,118C,139C 'authent':78B,138C 'author':152C 'bypass':151C 'check':58B,153C 'code':5A,70B,128C,144C 'configur':136C 'cross':162C 'cross-ten':161C 'cve':15A,23A 'cwe':27B 'data':164C 'default':135C 'defin':46B,100C 'deseri':9A,43B,97C,155C 'dill':12A,54B,112C 'dill-seri':11A 'execut':6A,71B,129C,145C 'feast':1A,26A,29B,38B,93C 'featur':31B,41B,74B,132C 'feature-stor':30B 'flaw':89C 'found':91C 'function':47B,101C 'get':68B 'gg2p':20A 'ghsa':19A 'ghsa-gg2p-37pv-v7fq':18A 'host':37B 'improp':96C 'later':167C 'lead':124C 'librari':55B,113C 'malici':65B,122C 'movement':168C 'packag':33B 'python':34B,40B 'registri':51B,86B,106C,148C 'remot':60B,117C 'result':159C 'safe':57B 'self':36B 'self-host':35B 'serial':13A,109C 'server':75B,87B,133C,149C 'store':32B,42B,48B,63B,103C,120C 'system':95C,171C 'tenant':163C 'udf':14A,66B,102C,123C 'unauthent':126C 'unsaf':8A 'use':52B,110C 'user':45B,79B,99C 'user-defin':44B,98C 'v7fq':22A 'via':7A 'vulner':2A,157C 'within':169C 'without':56B","nicknames":[],"mitigations":[],"who_affected":"Teams running a Feast feature server or registry that is on a version before `0.67.0`. The sources say the feature server is exploitable unauthenticated in default configurations, so any reachable deployment should be treated as exposed. Teams that do not run Feast servers in production, or that have already moved to `0.67.0` or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["feast"],"ptokens":["feast"],"labels":["critical","cwe502","feast","featurestore","package","pypi","python","selfhosted"],"campaign_type":null,"first_public_at":"2026-08-10T21:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gg2p-37pv-v7fq","url":"https://github.com/advisories/GHSA-gg2p-37pv-v7fq","severity":"critical","published_at":"2026-08-10T21:32:07+00:00","modified_at":"2026-11-03T16:23:47+00:00","first_seen_at":"2026-11-03T16:25:28+00:00","fetched_at":"2026-11-03T16:25:28+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-18948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18948","severity":null,"published_at":"2026-08-10T21:17:21+00:00","modified_at":"2026-09-28T10:16:44+00:00","first_seen_at":"2026-11-03T16:51:48+00:00","fetched_at":"2026-11-03T16:51:48+00:00","note":null}],"documents":[{"id":58881,"url":"https://github.com/feast-dev/feast/pull/6861","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58882,"url":"https://github.com/feast-dev/feast/commit/e0ef16ea1ed149ecd5dc9d4d0aa0fdbfa547f861","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58883,"url":"https://github.com/feast-dev/feast/releases/tag/v0.67.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}