CVE-2026-18942
Description
A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of privileges, granting the tenant administrative control over the Kubernetes cluster.
Statement
This Important vulnerability in Red Hat OpenShift AI allows a tenant to escalate privileges by controlling their feature repository. The Feast operator's feast apply CronJob executes arbitrary Python code from the repository with the feature-server's ServiceAccount permissions, enabling access to its token and potentially leading to cluster-admin equivalent access.
Mitigation
Configure the Feast operator to use a dedicated, minimally-privileged ServiceAccount for the `feast apply` CronJob, ensuring `automountServiceAccountToken: false` is set. Apply a restricted `securityContext` to the CronJob pod and implement network policies to limit egress to only required registry endpoints. Ensure the CronJob ServiceAccount is separate from the feature-server ServiceAccount.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 5.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | High | N/A | High |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
