CVE-2026-92787: Feast through 0.66.0 Authentication Bypass via Unverified Token
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any network-reachable attacker can exploit it without authentication or user interaction. The issue is rated with network attack vector, low complexity, and no required privileges.
What does an attacker need to bypass access controls?
The attacker needs to present an unverified JWT containing the hardcoded claim value used to establish a trusted internal identity. Because token signatures are not verified, the token does not need to be legitimately signed.
What access can successful exploitation provide?
Successful exploitation bypasses all role-based access control and can provide unchecked read and write access to server entities, feature views, data sources, and permission policies.
Which Feast versions are affected?
Feast versions through 0.66.0 are affected.