CVE-2026-18942 describes a flaw in the Feast operator where a malicious tenant can inject arbitrary code into their feature repository. This code is executed by an automated process running with elevated privileges, which can lead to theft of sensitive credentials and privilege escalation to administrative control over the Kubernetes cluster. The vulnerability has a CVSS 3.1 base score of 5.5, with network attack vector, high attack complexity, and requires high privileges but no user interaction. The vendor advisory from Red Hat references this CVE as part of a broader set of vulnerabilities affecting Red Hat OpenShift AI but does not explicitly state a patch or fix for this CVE alone. Updated images for Red Hat OpenShift AI are available, and users are directed to upgrade their clusters following vendor documentation.

Successful exploitation allows a malicious tenant to execute arbitrary code with elevated privileges, steal sensitive credentials, and escalate privileges to gain administrative control over the Kubernetes cluster. This can compromise cluster integrity and confidentiality. The medium CVSS score reflects the requirement for high privileges and attack complexity, but the impact on confidentiality is high and availability is low.

The vendor advisory does not explicitly state a direct fix for CVE-2026-18942 but provides updated images for Red Hat OpenShift AI and instructions for upgrading clusters. Users should follow the official Red Hat OpenShift AI upgrade documentation to apply the latest updates. Patch status is not explicitly confirmed for this CVE alone; therefore, check the vendor advisory regularly for updated remediation guidance.