Description

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of privileges, granting the tenant administrative control over the Kubernetes cluster.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-10T21:17:20.960Z",
  "pubdate": "2026-08-10T21:17:20.960Z",
  "executiveSummary": "A critical code injection vulnerability has been identified within the Feast operator, representing a significant security risk to multi-tenant Kubernetes environments.\nThe vulnerability allows an untrusted, malicious tenant operating within the cluster to inject arbitrary code into their feature repository.\nThis injected payload is subsequently executed by an automated process running with elevated privileges within the Kubernetes cluster.\nSuccessful exploitation of this flaw leads to the compromise of sensitive credentials managed or accessed by the automated background process.\nConsequently, this enables a direct and critical escalation of privileges, ultimately granting the malicious tenant full administrative control over the underlying Kubernetes cluster.\nThe risk implications include total cluster takeover, data exfiltration, and lateral movement across all deployed workloads.\nAttack capabilities require tenant-level access to the Feast operator environment and the ability to define or modify a feature repository.\nNo specific version numbers or external network exposure vectors are detailed in the initial disclosure, but the core vulnerability stems from insufficient input sanitization and insecure execution practices within the operator's automated pipeline.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure handling and processing of tenant-supplied feature repositories by the Feast operator.\nThe vulnerable component is the automated execution engine or reconciliation loop within the Feast operator responsible for parsing and interacting with tenant-defined feature store configurations.\nExploitation occurs when a malicious tenant leverages their authorized access to introduce arbitrary executable code into their feature repository definition.\nBecause the Feast operator's automated process lacks proper input validation, sanitization, or sandboxing mechanisms, it ingests the repository and inadvertently executes the embedded malicious code.\nThe attack flow proceeds as follows: First, the malicious tenant crafts a feature repository containing serialized payloads or execution hooks. Second, the tenant submits or triggers the reconciliation of this repository within the Feast operator. Third, the automated operator process, operating with high-level cluster permissions (such as elevated service account privileges), processes the repository and executes the payload. Fourth, the executing payload interacts with the cluster environment or metadata endpoints to harvest sensitive credentials, tokens, or configuration secrets.\nThe post-exploitation impact includes the acquisition of cluster-admin privileges, allowing the attacker to manipulate Kubernetes custom resource definitions, read secrets across all namespaces, deploy malicious pods, and completely subvert the security posture of the Kubernetes cluster.\nAuthentication and privilege requirements for initial exploitation are limited to tenant-level access within the cluster where the Feast operator is deployed, enabling the creation or modification of feature repositories."
}