Unauthenticated WebSocket endpoint in Feast Feature Server allows remote attackers to establish persistent connections without authentication, enabling resource exhaustion and potential information disclosure. Version affected: <= 0.58.0.

A vulnerability has been identified in the Feast Feature Server’s /save-document endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling an attacker to overwrite vital application configurations or startup scripts. Because this flaw requires no credentials or special privileges, any attacker with network access to the server can potentially compromise the integrity of the system. This could lead to unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution.

Unauthenticated arbitrary file write vulnerability in Feast Feature Server /save-document endpoint allows remote attackers to write JSON files to the filesystem with bypassable path restrictions. Version affected: <=0.58.0

A security issue was discovered in the Feast Feature Server's /read-document endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to potentially retrieve sensitive system files, application configurations, and credentials.