---
id: CVE-2026-18947
title: >-
  Feast: feast: authorization bypass in /materialize endpoints enables dos via
  unauthorized full re-materialization
summary: >-
  A flaw was found in Feast. An authorization bypass vulnerability exists in the
  /materialize and /materialize-incremental endpoints. By sending a specially
  crafted request that omits the feature_views field, an attacker can bypass
  intende…
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L'
cvssSource: cna
vendor: Red Hat
product: rhoai/odh-feature-server-rhel9
affected:
  - rhoai/odh-feature-server-rhel9 (all versions)
  - rhoai/odh-feature-server-rhel9 (all versions)
  - rhoai/odh-feature-server-rhel9 (all versions)
  - rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
  - rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
  - rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9
  - rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
  - rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
  - rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
  - rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
  - rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
  - rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
  - rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
  - rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
  - rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
  - rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-11T15:28:17.828269Z'
published: '2026-08-10'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T11:10:12.365Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-18947'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:53261'
    label: 'RHSA-2026:53261'
  - url: 'https://access.redhat.com/errata/RHSA-2026:53263'
    label: 'RHSA-2026:53263'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84734'
    label: 'RHSA-2026:84734'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-18947'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2511164'
    label: RHBZ#2511164
tags:
  - cve.org
epss: 0.00594
epssPercentile: 0.4728
ingestedAt: '2026-10-19T12:27:23.803Z'
---

## Overview

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.

## Affected

- `rhoai/odh-feature-server-rhel9 (all versions)`
- `rhoai/odh-feature-server-rhel9 (all versions)`
- `rhoai/odh-feature-server-rhel9 (all versions)`
- `rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9`
- `rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9`
- `rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9`
- `rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9`
- `rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9`
- `rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9`
- `rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9`
- `rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9`
- `rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9`
- `rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9`
- `rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9`
- `rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9`
- `rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this vulnerability, restrict network access to the Feast feature server to trusted clients only, using firewall rules or network policies. If the Feast feature server is configured with the default `no_auth` setting, enable Kubernetes/OIDC authentication to require user authentication for access. While enabling authentication will prevent unauthenticated exploitation, any authenticated user will still be able to trigger the denial of service due to the authorization bypass.