External risk intelligence

Feast Registry Deserialization Vulnerability Allows Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-18948

Feast is a feature store typically deployed within data engineering and machine learning infrastructure pipelines. While it may be network-reachable in some architectures to facilitate data access, it is generally positioned in internal backend environments rather than as a public-facing edge service, web gateway, or internet-exposed management portal.

Deserialization

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Feast allows attackers to execute arbitrary code by submitting malicious user-defined functions, potentially leading to unauthorized access and lateral movement across data tenants. This issue stems from improper deserialization of these functions, which are stored in the registry.

Malicious code can run on feature servers.
Affects data access and movement between tenants.
Confirm Feast's relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can compromise the Feast system by submitting a malicious user-defined function (UDF) that is improperly deserialized. If the system is configured by default, this can lead to arbitrary code execution on the feature server without authentication. An authenticated attacker can also achieve arbitrary code execution on the registry server by circumventing authorization checks during the deserialization process. This vulnerability could allow an attacker to access data across different tenants or move laterally within the system.

Requires network access.
Malicious user-defined function deserialization.
Arbitrary code execution and lateral movement.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary code on Feast's feature and registry servers. This could lead to unauthorized access to sensitive data across different tenants within the system and facilitate further compromise of connected services. The risk is present when the system improperly deserializes user-defined functions.

Feature server code execution.
Malicious UDFs can be stored.
Cross-tenant data access is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Responsible teams, including data platform and security operations, must first locate all Feast deployments. Confirming network reachability and business criticality of each instance will inform prioritization for remediation planning, engaging with accountable owners for coordinated action.

Data platform and security teams own this.
Verify Feast deployment reachability and criticality.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Feast and why is it used?

Feast is an open-source feature store designed to manage and serve data for machine learning models. It acts as a bridge between data infrastructure and model training, allowing data engineers to standardize how features are defined and retrieved across teams to ensure consistency in production pipelines.

How does CVE-2026-18948 cause a security weakness?

This vulnerability is an insecure deserialization flaw. Feast uses the 'dill' library to handle user-defined functions (UDFs) in its registry. Because the system improperly deserializes this data, an attacker can craft a malicious UDF that, when processed, tricks the server into executing unauthorized code instead of just loading the function.

Do I need to be authenticated to trigger this flaw?

It depends on which part of the system is targeted. In default configurations, an unauthenticated attacker can trigger code execution on the feature server by submitting a malicious function. On the registry server, the system requires the attacker to bypass authorization checks during the deserialization process to achieve the same result.

Is my Feast deployment at high risk according to Halo Surface Signal?

Halo Surface Signal notes that while Feast is critical to machine learning pipelines, it is typically housed in internal backend environments. It is rarely positioned as a public-facing edge service or internet gateway. If your instance is isolated within your internal network, the reachability risk may be lower than a service exposed directly to the public internet.

Why should I start by mapping my Feast instances?

Because Feast is often deployed across various data pipelines, you must first identify every instance to understand where your data sits. By mapping these deployments, you can determine which servers are network-reachable and prioritize those that are most critical to your organization, allowing for a coordinated response plan.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.