CVE-2026-18941Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication

Description

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.

Timeline

Scores

EPSS (exploitation in 30 days)

0.90% · top 40% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.7.

Affected products

• Red Hat · Red Hat OpenShift AI 2.25

  • unaffected 1786110051 – < *

• Red Hat · Red Hat OpenShift AI 3.3

  • unaffected 1786110033 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1786107278 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791868194 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791833225 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791868238 – < *

• Red Hat · Red Hat OpenShift AI (RHOAI)

  All versions: unaffected

• Red Hat · Red Hat OpenShift AI (RHOAI)

  All versions: unaffected

• Red Hat · Red Hat OpenShift AI (RHOAI)

  All versions: unaffected

• Red Hat · Red Hat OpenShift AI (RHOAI)

  All versions: unaffected

• Red Hat · Red Hat OpenShift AI (RHOAI)

  All versions: unaffected

• Red Hat · Red Hat OpenShift AI (RHOAI)

  All versions: unaffected

• Red Hat · Red Hat OpenShift AI (RHOAI)

  All versions: unaffected

• Red Hat · Red Hat OpenShift AI (RHOAI)

  All versions: unaffected

• Red Hat · Red Hat OpenShift AI (RHOAI)

  All versions: unaffected

• Red Hat · Red Hat OpenShift AI (RHOAI)

  All versions: unaffected

What to do

Workaround: To mitigate this vulnerability, configure Feast deployments to utilize Kubernetes RBAC authentication. Ensure that `FeatureStore` Custom Resources (CRs) explicitly define an authentication mechanism other than `no_auth`. For Feast SDK usage, avoid the `no_auth` setting in production environments unless `FEAST_INSECURE_NO_AUTH=1` is explicitly set, acknowledging the security implications. Applying these configuration changes will require a redeployment or restart of the affected Feast services.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-55815 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-18941](https://cveledger.app/badge/CVE-2026-18941.svg)](https://cveledger.app/cve/CVE-2026-18941)

Record last updated 19 Oct 2026, 11:10 UTC.