CVE-2026-92787
Description
A flaw was found in Feast. The application fails to verify JSON Web Token (JWT) cryptographic signatures before establishing user identity. A remote, unauthenticated attacker can exploit this issue by supplying an unverified token to bypass role-based access controls and assume a trusted internal identity. Consequently, the attacker can gain unauthorized read and write access to all data sources, feature views, entities, and security policies on the server.
Statement
Red Hat Product Security has rated this issue as Important. The upstream Critical score assumes a Feast deployment that uses the project Helm chart, which sets INTRA_COMMUNICATION_BASE64 to the public constant base64("intra-server-communication"). In that configuration, a remote unauthenticated attacker can present an unsigned JWT carrying that claim and skip Feast role-based access control.
Red Hat OpenShift AI deploys Feast with feast-operator, which does not use that constant. Releases before 3.4 do not set INTRA_COMMUNICATION_BASE64, so the trust check never matches. Starting with 3.4, the operator generates a per-instance 32-byte random value, stores it in the namespaced ConfigMap feast-
Mitigation
Restrict network exposure by limiting access to the Feast service endpoint to trusted administrative hosts or dedicated internal networks. On Red Hat Enterprise Linux host deployments, restrict incoming traffic on the service port using firewalld:
firewall-cmd --permanent --remove-port=<PORT>/tcp
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_CIDR>" port port="<PORT>" protocol="tcp" accept'
firewall-cmd --reload
In Kubernetes or OpenShift environments, enforce NetworkPolicies to prevent ingress from untrusted namespaces and external endpoints. Additionally, deploy an authenticating reverse proxy or API gateway in front of Feast to cryptographically validate JWT signatures before forwarding requests.
Warning: Reloading firewall configurations may temporarily interrupt established network sessions. Restricting network reachability will block clients located outside the designated trusted ranges.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
