Description

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T21:17:21.290Z",
  "pubdate": "2026-08-10T21:17:21.290Z",
  "executiveSummary": "A critical security flaw has been identified in Feast concerning the improper deserialization of user-defined functions (UDFs).\nThe vulnerability stems from the reliance on the 'dill' library to deserialize UDFs stored within the system registry.\nThis architectural weakness permits remote attackers to store malicious UDF payloads, resulting in unauthenticated arbitrary code execution on the feature server under default configurations.\nAdditionally, authenticated attackers can achieve arbitrary code execution on the registry server by successfully bypassing existing authorization checks during the deserialization routine.\nThe broader risk implications include cross-tenant data access and the facilitation of lateral movement throughout the affected infrastructure.\nExploitation requires the capability to interact with the feature or registry server interfaces to inject or manipulate stored UDF objects.\nThe risk profile is severe, as it compromises the core integrity and confidentiality of the feature store environment.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure deserialization mechanism implemented within Feast for handling user-defined functions (UDFs).\nThe system utilizes the 'dill' serialization library to serialize and deserialize UDFs stored in the registry.\nBecause 'dill' is capable of serializing arbitrary Python objects and functions, unvalidated or untrusted data passed into the deserialization pipeline executes arbitrary Python code upon reconstruction.\nThe attack flow begins when an unauthenticated remote attacker injects or stores a malicious UDF payload within the Feast registry.\nWhen the feature server processes or loads the compromised registry data in its default configuration, it invokes the insecure deserialization routine via 'dill'.\nThis triggers the evaluation and execution of the embedded malicious payload, granting the attacker arbitrary code execution with the privileges of the feature server process.\nSimilarly, an authenticated attacker can leverage authorization bypass vulnerabilities during the deserialization phase to target the registry server, achieving arbitrary code execution within that component as well.\nNetwork exposure varies depending on the deployment topology, but default configurations of the feature server are susceptible to remote unauthenticated interaction.\nPost-exploitation impact includes complete system compromise, cross-tenant data access due to shared or insufficiently isolated contexts, and the ability to execute lateral movement attacks across adjacent internal network segments."
}