---
id: CVE-2026-56121
title: >-
  Feast before 0.63.0 contains an unsafe deserialization vulnerability that
  allows unauthenticated or unauthorized attackers to achieve remote code
  execution by sending a crafted gRPC request to the registry server
summary: >-
  Feast before 0.63.0 contains an unsafe deserialization vulnerability that
  allows unauthenticated or unauthorized attackers to achieve remote code
  execution by sending a crafted gRPC request to the registry server. The
  user_defined_functi…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
  - CWE-502
published: '2026-06-24'
updated: '2026-08-28'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56121'
references:
  - url: >-
      https://github.com/feast-dev/feast/commit/835cda8e2c1359f1f496ad72701dbd6a73bdb25a
    label: disclosure@vulncheck.com
  - url: 'https://github.com/feast-dev/feast/releases/tag/v0.63.0'
    label: disclosure@vulncheck.com
  - url: 'https://huntr.com/bounties/d64b8111-180b-46ba-afa3-c877fda2ede6'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/feast-unauthenticated-rce-via-applyfeatureview-grpc-deserialization
    label: disclosure@vulncheck.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:60520'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-56121'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2492229'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56121.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
  - exploit-available
epss: 0.01406
epssPercentile: 0.71425
ingestedAt: '2026-08-29T00:27:53.736Z'
exploits:
  github: 3
  githubRepos:
    - 'https://github.com/0xdak/CVE-2026-56121_exploit'
    - 'https://github.com/BiiTts/CVE-2026-56121-Feast-Unauth-RCE'
    - 'https://github.com/joaovicdev/EXPLOIT-CVE-2026-56121'
  checkedAt: '2026-09-25T08:21:03.661Z'
exploitAvailable: true
---

## Overview

Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.