---
id: CVE-2024-11602
aliases:
  - GHSA-wxpc-2674-rxvw
  - PYSEC-2026-1367
title: Feast Cross-Origin Resource Sharing vulnerability
summary: Feast Cross-Origin Resource Sharing vulnerability
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'
vendor: feast
product: feast
ecosystem: pip
affected:
  - feast <= 0.40.0
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wxpc-2674-rxvw'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-11602'
  - url: 'https://github.com/feast-dev/feast'
  - url: 'https://huntr.com/bounties/7b24ecbe-0af7-4125-ab56-bce09786042e'
tags:
  - osv
  - pip
epss: 0.00303
epssPercentile: 0.20432
ingestedAt: '2026-07-08T18:25:53.937Z'
---

## Overview

A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.

## Affected packages

- `feast <= 0.40.0`

## Remediation

Refer to the advisory for the patched release.