CVE-2026-18947
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A vulnerability in Feast allows authorization bypass in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass permission checks, allowing an unauthenticated remote attacker or any authenticated user to trigger a full re-materialization of all feature views. This results in a Denial of Service (DoS) due to data corruption and significant resource consumption.
Risk Assessment
An attacker can cause service unavailability (DoS) by overloading the system and corrupting data, affecting all tenants.
Recommendation
Update Feast to a patched version and implement proper request validation.
Original NVD description (English source)
A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.