The Feast Feature Server contains a vulnerability in its /save-document endpoint that permits unauthenticated remote attackers to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file write locations, these protections can be bypassed, allowing attackers to overwrite important application configurations or startup scripts. This vulnerability requires no privileges or authentication, making it accessible to any attacker with network access to the server. The impact includes potential unauthorized system modifications, denial of service through disk exhaustion, and possible remote code execution. No patch or official remediation level has been confirmed as of the published date. The vendor advisory from Red Hat is available but does not specify a fix or mitigation status.

An attacker can write arbitrary JSON files without authentication, potentially overwriting vital application configurations or startup scripts. This can compromise system integrity, cause denial of service by exhausting disk space, or enable remote code execution. The vulnerability poses a critical risk due to its ease of exploitation and potential for severe impact on availability and integrity.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-23537 for current remediation guidance. Until an official fix is available, restrict network access to the Feast Feature Server to trusted users only and monitor for suspicious activity related to file writes on the server. Avoid exposing the /save-document endpoint to untrusted networks.