Feast-dev vulnerabilities
We track 5 vulnerabilities in Feast-dev products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 21, 2026.
Latest Feast-dev vulnerabilities
- 8.9 High severity
feast: Incorrect Authorization
Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_tests.yml uses pull_request_target with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits,
- 9.8 Critical severity
feast: Use of Hard-coded Credentials
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identi
- 9.8 Critical severity
feast: Deserialization of Untrusted Data
Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnD
- 7.8 High severity
feast-dev/feast: Deserialization of Untrusted Data
A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py`. The vulnerability arises from the use of
- 7.4 High severity
feast-dev/feast: Origin Validation Error
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API.