---
id: "CVE-2026-56121"
kind: "vulnerability"
aliases: ["CVE-2026-56121", "GHSA-q63x-9pfm-mjx4"]
title: "Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto"
severity: "critical"
cvss: 9.8
epss: 0.01406
exploited: false
status: "open"
category: "package"
products: [{"name": "feast", "fixed": ["0.63.0"], "affected": "< 0.63.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-502", "feast", "feature-store", "grpc", "package", "python"]
not_affected_if: ["client-only-use", "registry-not-exposed"]
published_at: "2026-06-24T16:16:33+00:00"
first_seen_at: "2026-11-03T21:24:57+00:00"
updated_at: "2026-11-03T22:07:19+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-q63x-9pfm-mjx4", "first_seen_at": "2026-11-03T21:24:57+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56121", "first_seen_at": "2026-11-03T22:07:19+00:00"}]
---

# Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto

Feast's registry server decodes a user-defined function field with dill.loads() before checking authorization. An attacker who sends a crafted gRPC request can embed a malicious Python object and run OS commands as the Feast service account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:feast affected < 0.63.0 fixed 0.63.0

## How to check

- Run `pip show feast` and check whether the version is below `0.63.0`
- Check whether the registry server is reachable over gRPC from untrusted networks
- Look for OnDemandFeatureView specs accepted from clients with a `user_defined_function.body` field

## Fix

- Upgrade Feast to `0.63.0` or later

## Timeline

- 2026-11-03T21:24:57+00:00 ghsa https://github.com/advisories/GHSA-q63x-9pfm-mjx4
- 2026-11-03T22:07:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56121

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/feast-unauthenticated-rce-via-applyfeatureview-grpc-deserialization
- [fix] Patch: github.com https://github.com/feast-dev/feast/commit/835cda8e2c1359f1f496ad72701dbd6a73bdb25a
- [fix] Release: github.com https://github.com/feast-dev/feast/releases/tag/v0.63.0

## From the sources

Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_