CVE-2026-18948: Feast Feature Store RCE via Unsafe Deserialization

Executive Summary

CVE-2026-18948 is a critical remote code execution vulnerability (CVSS 9.9) in Feast, a widely used open-source ML feature store. The vulnerability stems from Feast's use of the Python dill library to serialize and deserialize user-defined functions (UDFs) stored in the feature registry. An attacker who can write to the Feast registry can store a maliciously crafted UDF that, when loaded by the feature server, executes arbitrary code — with no authentication required in default configurations.

CVSS Score: 9.9 (Critical)

Vulnerability Details

Root Cause: Unsafe Deserialization

Python's dill library is a superset of pickle that can serialize virtually any Python object — including executable code and OS commands. When an object is deserialized using dill.loads(), Python executes whatever code the serialized payload encodes. This is the classic insecure deserialization pattern.

Feast stores UDFs (user-defined transformation functions) in its registry using dill serialization. The feature server then loads and deserializes these UDFs without validating their origin or content. Any attacker who can write a UDF to the registry can deliver a malicious payload that executes when the feature server loads it.

Exploitation Flow

1. Attacker gains write access to the Feast feature registry (may be unauthenticated in default configurations, or attainable via other means)
2. Attacker crafts a malicious Python UDF using dill that encodes an OS command or reverse shell payload
3. Malicious UDF is registered with Feast as a legitimate transformation function
4. The Feast feature server loads the registry and deserializes the UDF
5. Arbitrary code executes in the context of the feature server process

Example of the vulnerability class (for educational context only):

The attack exploits the fact that dill.loads(untrusted_data) is equivalent to eval() on arbitrary code. Feast trusted the registry contents without verifying that deserialized objects were safe.

Why CVSS 9.9?

• Remote exploitability with network access to the registry
• No authentication in default Feast deployments
• Full scope change — attacker pivots from registry write to full server compromise
• Complete impact on confidentiality, integrity, and availability of the ML infrastructure

Affected Deployments

This vulnerability affects Feast deployments that:

• Use the default UDF/on-demand feature view configuration with dill serialization
• Expose the feature registry with insufficient access controls
• Run the feature server in environments where registry access is broadly permitted

Consult the Feast GitHub Security Advisories for specific affected versions and fixed releases.

Impact on ML Infrastructure

Feast is used in production ML pipelines at organizations running real-time feature serving. A compromised feature server has access to:

• Training and serving data flowing through the feature store
• Model inputs that could be manipulated for model poisoning attacks
• Cloud credentials (if the server runs with cloud provider IAM permissions)
• Internal network access to downstream databases and data warehouses
• Kubernetes service account tokens in containerized deployments

This is not just a server compromise — it is a potential ML pipeline integrity attack.

Remediation

1. Apply Feast Patches

Update Feast to the patched version as soon as it is available. The fix should replace dill deserialization with a safe alternative that does not execute arbitrary code on load.

Monitor the Feast release page and security advisories.

2. Restrict Registry Write Access (Immediate)

Until a patch is applied, enforce strict access controls on the Feast feature registry:

# If using a file-based registry, restrict filesystem permissions
chmod 640 /path/to/feast/registry.db
chown feast-server:feast-admins /path/to/feast/registry.db
 
# If using a cloud-based registry (GCS, S3), apply bucket policies
# to allow writes ONLY from trusted CI/CD pipelines and admin identities

For S3-backed registries:

{
  "Statement": [{
    "Effect": "Deny",
    "NotPrincipal": {
      "AWS": [
        "arn:aws:iam::ACCOUNT:role/feast-admin-role",
        "arn:aws:iam::ACCOUNT:role/ci-cd-role"
      ]
    },
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::feast-registry-bucket/*"
  }]
}

3. Network Segmentation

Restrict network access to the Feast feature server and registry to only trusted services and pipelines. The feature server should not be publicly accessible.

4. Long-Term: Replace dill with Safe Serialization

Advocate with your team and upstream to replace dill/pickle UDF serialization with a safe alternative:

• Store UDF source code (as text) and evaluate it in a sandboxed environment rather than deserializing binary payloads
• Use a schema-validated approach where UDF definitions are declarative configurations rather than arbitrary serialized objects
• Sign and verify serialized objects cryptographically before deserialization

Detection

Audit Registry UDFs

Inspect your Feast registry for unexpected or recently modified UDFs:

from feast import FeatureStore
 
store = FeatureStore(repo_path=".")
# List all on-demand feature views (which use UDFs)
for odfv in store.list_on_demand_feature_views():
    print(f"Name: {odfv.name}, Created: {odfv.created_timestamp}")

Look for UDFs registered outside of expected CI/CD windows or by unexpected principals.

Runtime Detection

Monitor the feature server process for:

• Unexpected outbound network connections (reverse shell indicators)
• Unusual subprocess spawning from the feature server
• File system writes in unexpected locations

# Monitor feature server process activity (Linux)
auditctl -a always,exit -F arch=b64 -S execve -F ppid=$(pgrep feast-server) -k feast-exec

Broader Context: Insecure Deserialization in ML Systems

CVE-2026-18948 is part of a broader pattern of insecure deserialization vulnerabilities in ML infrastructure. Python's pickle and dill libraries are widely used in the ML ecosystem (model serialization, feature stores, experiment tracking) but are fundamentally unsafe when used with untrusted data.

Other ML tools with similar risks:

• Model files saved with pickle and loaded without verification
• joblib files from untrusted sources
• NumPy .npy files with allow_pickle=True from external sources

Organizations running ML infrastructure should audit all deserialization points and prefer format-specific safe loaders (ONNX, SafeTensors for models; JSON/Parquet for feature data) over generic Python serialization.

References

• NVD — CVE-2026-18948
• Feast Feature Store — GitHub
• OWASP A8 — Insecure Deserialization
• Python dill Library
• SafeTensors — Safe Model Serialization