CVE-2026-56121 affects feast before version 0.63.0 and involves unsafe deserialization of untrusted data. Specifically, the user_defined_function.body field in an OnDemandFeatureView specification is decoded from base64 and passed to dill.loads() before any authorization is performed. This allows unauthenticated or unauthorized attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method, leading to remote code execution on the registry server with the privileges of the feast service account.

Successful exploitation allows remote, unauthenticated attackers to execute arbitrary operating system commands on the feast registry server, potentially compromising the entire system and data accessible by the feast service account. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not explicitly state a fix or workaround. Until a patch is available, restrict access to the feast registry server to trusted users and networks to mitigate exploitation risk. Monitor official vendor channels for updates and apply any official fixes once released.