CVE-2026-18942 describes a flaw in the Feast operator component where a malicious tenant can inject arbitrary code into their feature repository. This code is executed automatically with elevated privileges, allowing credential theft and privilege escalation to administrative control over the Kubernetes cluster. The vulnerability has a CVSS 3.1 base score of 5.5, reflecting network attack vector, high attack complexity, required privileges, no user interaction, and impacts confidentiality, integrity, and availability to varying degrees. The Red Hat advisories mention updated images for Red Hat OpenShift AI but do not explicitly state a patch for this CVE, indicating that remediation instructions are forthcoming or integrated in broader updates.

Successful exploitation allows a malicious tenant to execute arbitrary code with elevated privileges, steal sensitive credentials, and escalate privileges to gain administrative control over the Kubernetes cluster. This compromises confidentiality, integrity, and availability of the affected environment. No active exploitation in the wild is currently known.

The vendor advisory from Red Hat indicates updated images for Red Hat OpenShift AI are available and provides documentation for upgrading clusters to apply these updates. Users should follow the official Red Hat OpenShift AI upgrade instructions to mitigate this vulnerability. Patch status is not yet explicitly confirmed for this CVE alone; therefore, check the vendor advisory regularly for updated remediation guidance.