CVE-2026-18947 is an authorization bypass vulnerability in Feast's /materialize and /materialize-incremental endpoints. An attacker can send a specially crafted request omitting the feature_views field to bypass intended permission checks, allowing unauthorized triggering of a full re-materialization of all feature views. This results in denial of service conditions caused by data corruption and significant resource consumption affecting all tenants. The vulnerability requires at least low privileges (PR:L) but no user interaction (UI:N) and is exploitable remotely (AV:N). The vulnerability is tracked under CWE-862 (Missing Authorization). Red Hat advisories mention the issue in the context of Red Hat OpenShift AI but do not list a patch or fix for this CVE at this time.

The vulnerability allows unauthorized users, including unauthenticated remote attackers or any authenticated user, to bypass authorization controls and trigger a full re-materialization process. This can cause denial of service through data corruption and excessive resource consumption impacting all tenants using the service. There is no indication of confidentiality or data disclosure impact. The high CVSS score reflects the significant integrity and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Red Hat advisories acknowledge the vulnerability but do not currently provide a fix. Users should monitor Red Hat's official documentation and errata for updates on patches or mitigations. Until a fix is available, restricting access to the affected endpoints and applying strict access controls may reduce risk.