CVE-2026-18941 Detail

Nvd.Nist • August 10, 2026

This CVE record has recently been published to the CVE List and has been included within the NVD dataset.

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Authentication Flaw in Feast SDK and Operator Exposes Systems to RCE A significant vulnerability, CVE-2026-18941, was identified in Feast and feast-operator due to the default 'no_auth' configuration, allowing unauthenticated access to critical endpoints. This flaw affects Red Hat OpenShift AI and could enable remote code execution (RCE) through malicious User-Defined Functions (UDFs), denial of service (DoS) attacks, and unauthorized access to cross-tenant data. The vulnerability impacts feature-server, registry-server, and offline-server endpoints, making it a serious concern for users operating in multi-tenant environments. To mitigate this risk, users are advised to implement Kubernetes RBAC authentication and avoid the 'no_auth' setting in production. The CVE was published on August 10, 2026, and remains a high priority for remediation. 1 sources 72

Extracted Entities

CVE-2026-18941 Detail

The full story

Extracted Entities

Attack Types (2)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)