The vulnerability in Feast arises from improper deserialization of UDFs stored in its registry using the 'dill' serialization library. An unauthenticated remote attacker can store a malicious UDF, resulting in arbitrary code execution on the feature-server pod under default settings. Additionally, an authenticated attacker can bypass authorization checks during deserialization to execute code on the registry-server pod. This unsafe deserialization leads to a scope change with high confidentiality, integrity, and availability impacts, enabling cross-tenant data access and lateral movement within Red Hat OpenShift AI environments.

Successful exploitation allows unauthenticated remote code execution on the feature server, compromising confidentiality, integrity, and availability of the system. Authenticated attackers can also achieve arbitrary code execution on the registry server by bypassing authorization. This can result in cross-tenant data exposure and lateral movement, significantly increasing the risk within multi-tenant deployments.

Red Hat recommends configuring Feast to enforce `auth.type: kubernetes` in the operator-generated configuration and to deny registry writes by default. This mitigation restricts registry modifications to authenticated and authorized users, preventing the deserialization of malicious UDFs. No official patch or fix is currently confirmed; users should apply these configuration changes to reduce the attack surface. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18948 for updates.