{"id":"CVE-2026-56121","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-56121","summary":"Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization","details":"Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account.","published":"2026-06-24T14:49:11.490Z","modified":"2026-10-28T02:30:29.566055422Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[],"fix":{"url":"https://github.com/feast-dev/feast/commit/835cda8e2c1359f1f496ad72701dbd6a73bdb25a","label":"feast-dev/feast@835cda8"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56121.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-56121"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56121.json"},{"type":"ADVISORY","url":"https://github.com/feast-dev/feast/releases/tag/v0.63.0"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56121"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/feast-unauthenticated-rce-via-applyfeatureview-grpc-deserialization"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492229"},{"type":"FIX","url":"https://github.com/feast-dev/feast/commit/835cda8e2c1359f1f496ad72701dbd6a73bdb25a"},{"type":"PACKAGE","url":"https://github.com/feast-dev/feast"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/d64b8111-180b-46ba-afa3-c877fda2ede6"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:29.566055422Z"}}