Description

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-10T21:17:20.777Z",
  "pubdate": "2026-08-10T21:17:20.777Z",
  "executiveSummary": "A critical security vulnerability has been identified in Feast and feast-operator related to missing authentication controls in the default configuration. Specifically, the default \"no_auth\" setting ensures that no security manager is installed across the architecture, exposing core services directly to the network. The affected products include the Feast SDK and feast-operator, which manage and deploy feature stores. The impact of this flaw is severe, encompassing remote code execution, denial of service, and cross-tenant data compromise. An unauthenticated remote attacker can exploit this missing authentication without requiring prior access or specialized privileges. By leveraging the exposed endpoints, the attacker can execute arbitrary code by storing malicious User-Defined Functions, disrupt availability by forcing the re-materialization of all tenant features, and compromise sensitive cross-tenant data. The risk implications are extensive, as multi-tenant deployments and cloud-native environments utilizing feast-operator face complete administrative compromise and data exfiltration vectors. Mitigation requires implementing proper authentication and authorization mechanisms to replace the insecure \"no_auth\" default configuration across all components.",
  "technicalDetails": "The vulnerability stems from an insecure default configuration in both Feast and feast-operator, where the authentication mechanism is explicitly set to \"no_auth.\" Under this default posture, no security manager is initialized or enforced within the architecture. As a result, critical core components, including the feature-server, registry-server, and offline-server endpoints, operate without any access control checks, leaving them entirely exposed to network traffic. This architectural design flaw allows any network-adjacent or remote attacker to interact directly with these backend servers without supplying valid credentials or proving authorization. The lack of authentication enables multiple high-severity attack vectors against the underlying system. First, an attacker can achieve remote code execution by uploading and storing a malicious User-Defined Function (UDF) directly onto the feature-server, which subsequently executes the arbitrary code within the server context. Second, an attacker can trigger a severe denial of service condition by issuing API commands that force the re-materialization of all tenant features, thereby exhausting computational and storage resources. Third, the absence of tenancy isolation enforcement at the endpoint layer grants unauthorized access to cross-tenant data, violating data confidentiality boundaries in shared environments. The attack flow begins with network reconnaissance to locate the exposed feature-server, registry-server, or offline-server endpoints deployed via feast-operator. Once identified, the unauthenticated attacker crafts malicious HTTP requests targeting the unprotected API routes. For remote code execution, the attacker submits a payload disguised as or containing a malicious UDF to the feature-server endpoints. Upon storage and subsequent invocation of the UDF, the runtime executes the embedded malicious instructions with the privileges of the Feast service. For the denial of service vector, the attacker invokes the materialization pipelines without restriction, overwhelming the infrastructure. For data exposure, the attacker queries the registry-server or offline-server endpoints directly, bypassing logical isolation to retrieve sensitive metrics and feature values belonging to other tenants. The vulnerable components comprise the core network endpoints exposed by the Feast SDK and feast-operator deployments utilizing the default \"no_auth\" configuration."
}