Threats tagged 'ghsa-2xfw-wg76-86w9'

A security flaw was identified in Feast and feast-operator where the default configuration uses "no_auth," allowing unauthenticated and unauthorized access to key Feast service endpoints. This vulnerability enables remote attackers to execute arbitrary code by uploading malicious user-defined functions, cause denial of service by forcing re-materialization of tenant features, and access data across tenants without authorization. The vulnerability is tracked as CVE-2026-18941 with a high severity score of 7.7. Red Hat has acknowledged this issue in their advisories related to Red Hat OpenShift AI but has not yet provided a fix. Users are advised to follow vendor guidance for mitigation and monitor updates for patches.