{"id":"CVE-2026-56121","kind":"vulnerability","aliases":["CVE-2026-56121","GHSA-q63x-9pfm-mjx4"],"related":[],"title":"Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto","description":"Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account.","summary":"Feast's registry server decodes a user-defined function field with dill.loads() before checking authorization. An attacker who sends a crafted gRPC request can embed a malicious Python object and run OS commands as the Feast service account.","severity":"critical","cvss":9.8,"epss":0.01406,"exploited":false,"exploited_at":null,"products":[{"name":"feast","fixed":["0.63.0"],"affected":"< 0.63.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-502","feast","feature-store","grpc","package","python"],"not_affected_if":["client-only-use","registry-not-exposed"],"how_to_check":"- Run `pip show feast` and check whether the version is below `0.63.0`\n- Check whether the registry server is reachable over gRPC from untrusted networks\n- Look for OnDemandFeatureView specs accepted from clients with a `user_defined_function.body` field","fix":"- Upgrade Feast to `0.63.0` or later","status":"open","published_at":"2026-06-24T16:16:33+00:00","first_seen_at":"2026-11-03T21:24:57+00:00","triaged_at":"2026-11-03T21:28:52+00:00","updated_at":"2026-11-03T22:07:19+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-03T21:28:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Feast to `0.63.0` or later","reach":"network","title":"Feast: crafted gRPC request runs code on registry server","impact":"high","summary":"Feast's registry server decodes a user-defined function field with dill.loads() before checking authorization. An attacker who sends a crafted gRPC request can embed a malicious Python object and run OS commands as the Feast service account.","audience":"developers","category":"package","nicknames":[],"who_cares":["feast","python","feature-store","grpc"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Code runs as the Feast service account on the registry server","analyst_note":"","how_to_check":"- Run `pip show feast` and check whether the version is below `0.63.0`\n- Check whether the registry server is reachable over gRPC from untrusted networks\n- Look for OnDemandFeatureView specs accepted from clients with a `user_defined_function.body` field","plain_action":"","needs_analyst":false,"not_affected_if":["client-only-use","registry-not-exposed"],"who_is_affected":"Teams running a Feast registry server that accepts gRPC requests, including requests that carry OnDemandFeatureView specs. Client-only use of Feast that never exposes the registry server is less exposed. The sources do not say whether authentication on the registry server changes exposure, because the deserialization runs before the authorization check.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000688,"input_tokens":4267,"output_tokens":523,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,22A '-502':26B '-56121':15A,23A '0.63.0':75C '9pfm':19A 'account':72B,145C 'achiev':88C 'allow':82C 'arbitrari':134C 'attack':51B,86C,124C 'author':49B,119C 'base64':112C 'check':48B,120C 'code':90C 'command':67B,140C 'contain':76C 'craft':55B,95C 'cve':13A,21A 'cwe':25B 'decod':38B,110C 'defin':42B 'deseri':5A,79C 'dill.loads':46B,116C 'emb':59B,126C 'enabl':123C 'execut':91C,138C 'feast':1A,24A,27B,34B,70B,73C,143C 'featur':29B 'feature-stor':28B 'field':44B,104C 'function':43B 'ghsa':17A 'ghsa-q63x-9pfm-mjx4':16A 'grpc':31B,56B,96C 'malici':61B,128C 'method':136C 'mjx4':20A 'object':63B,131C 'ondemandfeatureview':107C 'os':66B,139C 'packag':32B 'pass':114C 'perform':122C 'proto':12A 'python':33B,62B,130C 'q63x':18A 'rce':6A 'reduc':135C 'registri':8A,36B,100C 'remot':89C 'request':57B,97C 'run':65B 'send':53B,93C 'serial':129C 'server':9A,37B,101C 'servic':71B,144C 'spec':108C 'store':30B 'udf':11A 'unauthent':83C 'unauthor':85C 'unsaf':4A,78C 'user':41B 'user-defin':40B 'user_defined_function.body':103C 'via':10A 'vulner':2A,80C","nicknames":[],"mitigations":[],"who_affected":"Teams running a Feast registry server that accepts gRPC requests, including requests that carry OnDemandFeatureView specs. Client-only use of Feast that never exposes the registry server is less exposed. The sources do not say whether authentication on the registry server changes exposure, because the deserialization runs before the authorization check.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["feast"],"ptokens":["feast"],"labels":["critical","cwe502","feast","featurestore","grpc","package","pypi","python"],"campaign_type":null,"first_public_at":"2026-06-24T16:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-q63x-9pfm-mjx4","url":"https://github.com/advisories/GHSA-q63x-9pfm-mjx4","severity":"critical","published_at":"2026-06-24T18:32:40+00:00","modified_at":"2026-11-03T21:20:57+00:00","first_seen_at":"2026-11-03T21:24:57+00:00","fetched_at":"2026-11-03T21:24:57+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-56121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56121","severity":null,"published_at":"2026-06-24T16:16:33+00:00","modified_at":"2026-10-25T22:10:00+00:00","first_seen_at":"2026-11-03T22:07:19+00:00","fetched_at":"2026-11-03T22:07:19+00:00","note":null}],"documents":[{"id":60961,"url":"https://github.com/feast-dev/feast/commit/835cda8e2c1359f1f496ad72701dbd6a73bdb25a","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60962,"url":"https://github.com/feast-dev/feast/releases/tag/v0.63.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":61063,"url":"https://www.vulncheck.com/advisories/feast-unauthenticated-rce-via-applyfeatureview-grpc-deserialization","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}