CVE-2026-18948: Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server
A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.
Other sources
Description
Finding On-demand, stream, and batch feature views serialize their Python UDF with dill.dumps() into the protobuf registry. Every consumer deserializes with dill.loads() without validation. dill is a pickle superset — dill.loads() on attacker-controlled bytes is arbitrary code execution (reduce).
Files:
sdk/python/feast/transformation/pandastransformation.py:150 — udf=dill.loads(userdefinedfunctionproto.body)
sdk/python/feast/transformation/pythontransformation.py:168 — same
sdk/python/feast/transformation/substraittransformation.py:163
sdk/python/feast/transformation/raytransformation.py:288
sdk/python/feast/streamfeatureview.py:335
sdk/python/feast/dqm/profilers/geprofiler.py:158
Repository: red-hat-data-services/feast ASVS: V5.5.3 (deserialization of untrusted data), V1.5.2 CWE: CWE-502 Severity: Critical
Attack Paths Path 1 — Feature server RCE (cross-tenant):
Tenant A stores a malicious UDF via ApplyOnDemandFeatureView (gRPC or REST)
The shared feature-server pod refreshes the registry and loads the ODFV
Payload executes as the feature-server service account when any user calls /get-online-features referencing that view, or immediately on fromproto
Because the feature-server serves all projects in a FeatureStore CR, this crosses tenant boundaries
When combined with F-04 (default noauth), step 1 requires no authentication at all.
Path 2 — Pre-authorization RCE on registry server: registryserver.py:341-354: fromproto() triggers dill.loads() before assertpermissionstoupdate runs. Even with auth.type: kubernetes/oidc enabled, any authenticated principal regardless of Feast permissions achieves RCE on the registry-server pod.
Impact Unauthenticated RCE on the feature-server pod in default configurations. With auth enabled, any authenticated principal achieves RCE on the registry-server pod (authz bypassed). Cross-tenant data access and lateral movement via the feature-server's SA and network position.
Remediation Document that registry write access is equivalent to code execution on the feature server
Force auth.type: kubernetes in operator-generated config and deny-by-default registry writes
Long-term: replace dill with the source-string + restricted-exec path (udfstring) or Substrait-only transformation mode
Immediate: move assertpermissionstoupdate before fromproto() in registry server to close the pre-authz bypass
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
feastto a version that resolves this vulnerability.Patch Feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server - Configuration
Force auth.type: kubernetes in operator-generated config and deny-by-default registry writes to prevent cross-tenant registry write access and pre-authz bypass exploitation.
Feast operator-generated configuration auth.type = kubernetes - Compensating control
In the registry server, move assert_permissions_to_update before from_proto() (registry_server.py:341-354) so from_proto() no longer triggers dill.loads() before authorization checks run, closing the pre-authz bypass.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18948?
CVE-2026-18948 has a critical severity rating of 9.9.
What type of vulnerability is CVE-2026-18948?
CVE-2026-18948 is classified as a remote code execution (RCE) vulnerability.
How do I fix CVE-2026-18948?
To fix CVE-2026-18948, update Feast to the latest version that addresses this deserialization flaw.
What can an attacker do with CVE-2026-18948?
An attacker can exploit CVE-2026-18948 to execute arbitrary code on the feature server by storing a malicious user-defined function.
Which components are affected by CVE-2026-18948?
CVE-2026-18948 affects the feature server and registry server components of the Feast system.