CVE-2026-55563
Description
A flaw was found in Feast. A fork contributor could exploit a vulnerability in the pull_request_target integration tests by first obtaining approval for a benign code revision. Subsequently, by pushing new commits, the ok-to-test label would persist, allowing untrusted code from their fork to execute with privileged production cloud secrets. This could lead to arbitrary code execution on the runner, disclosure of sensitive credentials, and potential unauthorized access to downstream cloud resources.
Statement
Red Hat rates this flaw as Important because the exposure of high-privilege cloud secrets and execution of unauthorized code inside build runners can result in substantial downstream infrastructure compromise. In the context of Red Hat products, this vulnerability resides entirely within the upstream project's GitHub Actions continuous integration automation rather than in the core software components or distributed runtime. Because Red Hat does not deploy or rely on the upstream repository test pipelines, Red Hat customer environments and product deployments remain unaffected.
Understanding the Weakness (CWE)
Other
Technical Impact: Alter Execution Logic; Unexpected State
By performing actions in an unexpected order, or by omitting steps, an attacker could manipulate the business logic of the product or cause it to enter an invalid state. In some cases, this can also expose resultant weaknesses with security implications.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
