https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:12:24 +0000 https://vulnerability.circl.lu/vuln/cve-2026-18941 <p><strong>Affected:</strong> Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI 3.4, Red Hat OpenShift AI (RHOAI)</p> <p>A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is &#34;no_auth,&#34; meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.</p> <p><strong>Affected:</strong> Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI 3.4, Red Hat OpenShift AI (RHOAI)</p> <p>A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is &#34;no_auth,&#34; meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.</p> https://vulnerability.circl.lu/vuln/cve-2026-18941