Threat Intelligence Report — CVE-2026-18947

Executive Summary

CVE-2026-18947 describes an authorization bypass vulnerability in Feast, an open-source feature store platform used for machine learning feature management. The flaw exists in the /materialize and /materialize-incremental endpoints, where a specially crafted request that omits the feature_views field can bypass intended permission checks. This permits an unauthenticated remote attacker — or any authenticated user regardless of privilege level — to trigger a full re-materialization of all feature views across all tenants, resulting in data corruption and significant resource consumption that constitutes a Denial of Service (DoS) condition. The vulnerability carries a CVSS score of 8.5 (High), with high impact to integrity and low impact to availability, expanded across security boundaries due to the scoped nature of the flaw.

All deployments of Feast exposing the affected endpoints are potentially at risk. No official vendor confirmation of the patch, no version-specific remediation guidance, and no public exploit code have been identified as of this report. Security teams operating Feast clusters should treat this vulnerability with high priority given the low complexity of exploitation and the network-only attack vector.

Technical Analysis

The NVD description identifies a flaw located in two API endpoints of the Feast feature store service: /materialize and /materialize-incremental. These endpoints are responsible for orchestrating the materialization of feature views — the process of computing and persisting feature values from source data into an online store for low-latency retrieval.

Vulnerability Mechanism:

The core issue is an authorization bypass predicated on the presence of the feature_views field within the request body. In a normal request, the feature_views field specifies which feature views are to be materialized, and the authorization layer presumably evaluates the requesting principal's permissions against each named view. When this field is absent from a request, the code appears to fall through to a default behavior that materializes all feature views without performing the per-view authorization check. This is a classic "missing input validation → default-to-unsafe-state" vulnerability pattern.

At the vulnerability-class level, this is an authorization bypass via incomplete request validation. The application relies on request-content-derived state (the presence of a particular field) to gate access control, rather than enforcing authorization independently of the request payload. An attacker who omits feature_views from the request body effectively causes the authorization logic to short-circuit, granting access to operations that should require explicit per-view permissions.

Attack Surface:

The attack surface is the network-exposed API surface of Feast. Because the CVSS vector indicates AV:N (Network) and PR:L (Low privileges required), the vulnerability is remotely exploitable. The PR:L scoring suggests that some form of authentication may be present, but the unauthenticated-remote-attacker note in the NVD description suggests that the endpoints may also be reachable without authentication in certain deployment configurations. The S:C (Scope Changed) component indicates that the impact extends beyond the vulnerable component's security scope, affecting all tenants sharing the Feast deployment.

Technical Detail Gaps:

The NVD description does not disclose:

• The exact code path that handles a null or missing feature_views field
• Whether the authorization bypass is a missing check, a default-to-permissive conditional, or an exception-handling flaw
• The specific implementation language or framework details (Feast is Python-based; however, we will not speculate beyond what is known)
• Whether the bypass affects both GET and POST request methods, or the exact Content-Type required

Without access to the patch diff or the underlying codebase at the vulnerable revision, sufficient technical detail is unavailable to provide a more granular analysis.

Exploitation Scenarios

Scenario Overview: The attack chain for CVE-2026-18947 can be inferred from the vulnerability class and description. No public PoC exists; the chain described below is derived strictly from the NVD description and generic API-exploitation techniques that apply to the stated flaw class.

Step 1 — Reconnaissance and Target Identification:
An attacker begins by identifying Feast instances exposed to the network. Feast deployments typically expose a gRPC or REST API on a well-known port. Enumeration techniques include:

• Scanning for open ports associated with Feast's serving/registry services
• Searching for web-accessible dashboards, documentation endpoints (Swagger/OpenAPI), or registry metadata that reveals the feature store backend
• Using search engine dorks such as those listed in the Shodan Dorks metadata to locate exposed instances

Once an instance is identified, the attacker probes the /materialize and /materialize-incremental endpoints using benign requests (e.g., empty bodies or optional fields present) to determine whether the service responds and whether authentication is enforced.

Step 2 — Authentication Bypass / Triggering the Flaw:
The attack mechanism is the omission of the feature_views field. The attacker crafts an HTTP request directed at one of the two endpoints with the following characteristics:

• Method: POST (typical for triggering materialization jobs)
• Body: JSON containing only the required structural fields that are not feature_views (e.g., temporal fields like start_time and end_time if those are expected for incremental materialization)
• The feature_views field is deliberately omitted from the request body

If the endpoint requires authentication, the attacker uses any valid low-privileged account credentials. According to the NVD description, the vulnerability also permits unauthenticated access in some configurations; in that case, no credentials are needed.

Step 3 — Payload/Execution at the Vulnerability-Class Level:
At the vulnerability-class level, the "payload" is not malicious code but rather a structurally incomplete valid request. The request passes minimal validation (valid JSON, required non-authorization fields present) yet triggers the default branch that materializes all feature views. This is analogous to an "empty allowlist defaults to allow-all" logic error. The attacker does not need to inject code or exploit a memory-corruption bug; a straightforward HTTP request with missing fields is sufficient.

Step 4 — Post-Exploitation Impact:
Upon successful triggering:

• Data corruption: Materializing all feature views simultaneously can lead to inconsistent state in the online store, particularly where concurrent writes to the same feature values occur. The integrity impact is rated High (I:H) in the CVSS vector.
• Resource exhaustion: The full re-materialization jobs consume significant CPU, memory, and I/O across all tenants sharing the instance. This causes latency degradation for legitimate feature retrieval and can crash the service, producing an availability impact rated Low (A:L) in the CVSS vector — low because the DoS is a side effect of resource consumption rather than a deliberate crash of a single component, though the scope change (S:C) broadens the blast radius. The word "significant resource consumption across all tenants" in the NVD description confirms the multi-tenant impact.

Weaponization Status: No public exploit code, Nuclei template, or Metasploit module is known at the time of writing. The attack is trivial to execute manually, requiring only crafted HTTP requests, so likelihood of weaponization by threat actors with HTTP scripting skills is high once the vulnerable versions are disclosed.

Impact Assessment

Business Impact:
Feast is a critical component of MLOps (machine learning operations) infrastructure. Feature materialization is a core operational task that must run on schedule and with consistency guarantees. An attacker who triggers unwanted materialization can:

• Corrupt the training/serving data foundation: If feature values are recomputed and stored erroneously, models served from the online store will produce incorrect predictions — a potentially silent integrity failure that affects downstream ML-driven business decisions (credit scoring, fraud detection, recommendation systems).
• Degrade service-level objectives (SLOs): Resource exhaustion slows feature retrieval for all tenants, breaking the low-latency guarantees essential for real-time inference workloads.
• Mask other malicious activity: The noise and degradation caused by the DoS may be used as a smokescreen to conceal other lateral movement within the data infrastructure.

Affected Systems:
Any Feast deployment exposing the /materialize or /materialize-incremental endpoints to untrusted networks — including cloud-hosted multi-tenant SaaS offerings, on-premises clusters with exposed APIs, and edge deployments with network reachability. The absence of affected version data means all currently released versions of Feast must be considered potentially vulnerable until the patch is confirmed and released.

Blast Radius (CVSS Reference):

• Attack Vector (AV:N): Remote exploitation over the network; no physical or adjacent-network access required.
• Attack Complexity (AC:L): No special conditions, race conditions, or user-interaction required.
• Privileges Required (PR:L): Low — authentication as a standard user is sufficient; the unauthenticated claim in the NVD description suggests that in default misconfigurations even this low bar is absent.
• User Interaction (UI:N): None required.
• Scope (S:C): The impacted resources extend beyond the component to all shared tenants, crossing security boundaries.
• Confidentiality (C:N): No direct data exfiltration impact.
• Integrity (I:H): Full materialization can write corrupted or overwritten data to the online store.
• Availability (A:L): Reduced availability due to resource exhaustion; not rated as total outage.

CVSS Score Calculation: 8.5 High. This reflects a serious, remotely exploitable flaw with high impact on data integrity in a multi-tenant context.

Detection Guidance

The following detection content is designed to identify exploitation attempts at the request level and the resulting anomalous resource behavior.

Sigma Rule

title: Feast Materialize Endpoint Authorization Bypass Attempt
id: 6f2e1d4a-9c3b-4d5e-8f0a-2b1c7e3a9f51
status: experimental
description: Detects HTTP requests to Feast /materialize or /materialize-incremental endpoints that omit the feature_views field, indicating a possible authorization bypass attempt.
author: Valtersit Threat Intel
date: 2026-01-15
tags:
    - attack.initial-access
    - attack.t1190
    - attack.impact
    - attack.t1499
logsource:
    category: webserver
    product: generic
    definition: 'Requires web server access logs capturing the full HTTP request body or a reverse proxy logging the body.'
detection:
    selection:
        cs-method: POST
        cs-uri-path:
            - '/materialize'
            - '/materialize-incremental'
    filter_feature_views_present:
        cs-body|contains: 'feature_views'
    condition: selection and not filter_feature_views_present
fields:
    - clientip
    - cs-uri-path
    - cs-body
    - cs-useragent
falsepositives:
    - Legitimate internal tooling or scripts that rely on default (all-views) materialization behavior (rare)
    - Monitoring processes that intentionally omit optional fields
level: high
status: experimental

Expected Trigger: This rule will fire when a POST request is made to either materialization endpoint without the feature_views field in the body. Note that not all web servers log request bodies; this rule works best in conjunction with reverse proxies or WAFs that log request payloads.

YARA Rule

/*
 * YARA rule to detect HTTP request payloads targeting
 * Feast /materialize and /materialize-incremental endpoints
 * with a missing feature_views field.
 */
rule Feast_AuthBypass_MissingFeatureViews {
    meta:
        author = "Valtersit Threat Intel"
        date = "2026-01-15"
        description = "Detects Crafted Requests to Feast Materialize endpoints lacking feature_views field."
        reference = "CVE-2026-18947"
        score = 85
    strings:
        $s_path_materialize = "/materialize"
        $s_path_incremental = "/materialize-incremental"
        $s_method_post = "POST" nocase
        $s_json_open = "{"
        // Absence check is negative; can only flag strings that are present
        $s_feature_views_present = "feature_views"
    condition:
        // Note: YARA cannot detect absence of a string directly.
        // This rule flags content that matches the endpoints and method,
        // and relies on second-stage analysis (the absence check) downstream.
        $s_method_post at 0 and
        (
            $s_path_materialize in (0..filesize) or
            $s_path_incremental in (0..filesize)
        ) and
        $s_json_open in (0..300) and
        // If this string is present, the request is NOT an attack per CVE-2026-18947.
        not $s_feature_views_present in (0..filesize)
}

YARA Limitations: YARA is a file-matching tool without native support for field absence checks across entire unstructured files. The rule above approximates the logic by checking for attack-path preconditions and relying on the not operator for the negative condition. In practice, a full-featured WAF or SIEM rule is more appropriate for precise detection.

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Feast Materialize Endpoint Authorization Bypass (CVE-2026-18947)";
    flow:established,to_server;
    http.method;
    content:"POST"; http_method;
    content:"/materialize"; http_uri;
    content:"/materialize-incremental"; http_uri;
    http.request_body;
    content:"feature_views"; http_request_body; 
    nocase; 
    // The rule below is a negative-match — we must split into two rules.
    metadata: referenceref cve-2026-18947;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-18947;
    classtype:attempted-admin;
    sid:202618947001;
    rev:1;
)

alert http any any -> any any (
   msg:"ET EXPLOIT Feast Materialize Endpoint Missing feature_views Field (CVE-2026-18947)";
    flow:established,to_server;
    http.method;
    content:"POST"; http_method;
    content:"/materialize"; http_uri;
    http.request_body;
    content:"feature_views"; http_request_body; nocase; 
    // This rule catches normal requests; we'd need a Lua-based rule for true absence.
    sid:202618947002; rev:1;
)

Suricata Note: Traditional signature-based Suricata rules cannot express "field absence" directly. The rules above will alert on requests associated with the endpoints, not strictly on the absence condition. For production detection, a Lua script or a custom parser is required to inspect the HTTP body and flag missing feature_views while filtering those that contain it.

Elastic Detection

EQL Query (based on HTTP logs with request body captured):

sequence by process.entity_id, host.id
  [ any where process.name == "logstash" or source.ip != null
    // Placeholder to anchor the sequence; the next where-clause captures the request
  ]

Due to Elastic's data-model variance, a more realistic EQL rule for request body fields looks like this:

any where event.category == "web" and
  http.request.method == "POST" and
  ( url.path == "/materialize" or url.path == "/materialize-incremental" ) and
  // The field below assumes a key-value body captured in structured logs.
  // If NOT EXISTS is not supported, use a filter and negation.
  not exists (http.request.body.content, "feature_views")

Practical Elastic (Lucene) Equivalent for Detect in Kibana:

{
  "query": {
    "bool": {
      "filter": [
        { "term": { "http.request.method": "POST" } },
        {
          "bool": {
            "should": [
              { "term": { "url.path": "/materialize" } },
              { "term": { "url.path": "/materialize-incremental" } }
            ],
            "minimum_should_match": 1
          }
        },
        { "must_not": { "exists": { "field": "http.request.body.content" } } }
      ]
    }
  }
}

Note: The above assumes Elastic's http.request.body.content field is populated with the request body. In practice, request bodies are often truncated in logs; enable body capture in your ingest pipeline for RESTful services.

Splunk SPL Query

index=proxy OR index=web OR index=iis
  method=POST
  uri_path IN ("/materialize", "/materialize-incremental")
  | eval has_feature_views = if(match(_raw, "feature_views"), "true", "false")
  | search has_feature_views="false"
  | table _time, src_ip, dest_ip, uri_path, http_user_agent, _raw

SPL Discussion:

• Assumes a proxy/index that logs raw request bodies (e.g., capture of _raw includes POST body).
• The match() function searches for the literal string feature_views.
• The search command filters to events where the field is absent.
• If request bodies are stored in a dedicated field (e.g., body), adjust the match target accordingly.

Alternative for gap-based detection:

If the proxy logs do not include request bodies, the SPL query cannot detect this flaw via body inspection. Instead, rely on the secondary detection — anomalous resource usage spikes:

index=beats_metrics OR index=ossim
  sourcetype=splunkd or sourcetype=snmp
  metric_name IN ("cpu_usage", "memory_usage")
  | timechart avg(metric_value) by host limit=10 span=5m
  | where avg(metric_value) > 80

Wazuh OSSEC Rule

<group name="feast,">
  <rule id="125091" level="15">
    <if_sid>40000</if_sid>
    <match>POST /materialize</match>
    <regex>^\d+.\d+.\d+.\d+.*POST /materialize.*HTTP/1.1" 200</regex>
    <description>Feast /materialize endpoint accessed without feature_views field in body</description>
    <group>attack.auth_bypass, CVE-2026-18947</group>
    <mitre><id>T1190</id><id>T1499</id></mitre>
    <options>no_full_log</options>
  </rule>
  <rule id="125092" level="15">
    <if_sid>40000</if_sid>
    <match>POST /materialize-incremental</match>
    <regex>^\d+.\d+.\d+.\d+.*POST /materialize-incremental.*HTTP/1.1" 200</regex>
    <description>Feast /materialize-incremental endpoint accessed without feature_views field in body</description>
    <group>attack.auth_bypass, CVE-2026-18947</group>
    <mitre><id>T1190</id><id>T1499</id></mitre>
    <options>no_full_log</options>
  </rule>
</group>

Wazuh Caveats: The OSSEC/Wazuh rules above rely on log stream parsing. Standard access logs do not capture the request body; the feature_views omission cannot be detected from common Apache/Nginx logs. The rules above trigger on any access to the endpoints, which would produce significant false positives. To make the rule practical, the regex must be extended to capture the body — which requires custom log formats that store the request body. Implement log-format changes as described in the detection notes above.

Recommended Approach: If request-body logging is not feasible, migrate the detection to the WAF or API-gateway layer (e.g., using a custom Lua script or a policy filter) instead of relying on Wazuh/SIEM log analysis.

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The NVD lists a patch source, but no CVE-affecting version, no commit hash, and no official vendor advisory have been verified. Treat the patch claim with suspicion; verify directly with the Feast authors or the Feast security mailing list before considering the issue resolved.

1. Immediate Mitigations (Do These Now)

1. Restrict Network Access:

   • Place the Feast serving/registry API behind a firewall or security group that limits access to trusted CIDR ranges only.
   • If the /materialize and /materialize-incremental endpoints are not required for your use case, block them at the reverse proxy (e.g., Nginx, Envoy, AWS ALB) with a 403 response.

2. Enable Authentication at a Higher Layer:

   • Add mutual TLS (mTLS) or an OIDC/API-key gate at the ingress layer so that even if the request reaches Feast, it requires valid credentials.
   • If Feast supports role-based access control (RBAC) natively, configure the strictest policy that denies all materialization by default and only allow specific views per user.

3. Request Body Validation (WAF/API Gateway):

   • Deploy an API-gateway level rule that requires the feature_views field in the request body. Any request missing this field should be rejected before reaching the application.
   • Example Nginx-Lua check:

     -- Pseudo-code; not an actual Nginx directive
     if (request_body_does_not_contain("feature_views")) then ngx.exit(403) end
     

4. Rate limiting: Apply rate limiting to materialization endpoints to slow down repeated abuse.

2. Patch/Upgrade Steps

• Check the Feast GitHub releases and changelogs for a security fix referencing CVE-2026-18947.
• Contact the Feast maintainers via the official security contact to confirm the patch exists and ask for the minimum patched version.
• When a patched version is released, follow standard upgrade procedures: back up the feature store registry, test the upgrade in a staging environment, and then roll out to production.
• Re-run your vulnerability scanner post-upgrade to confirm the endpoints no longer exhibit the bypass behavior.

3. Long-Term Hardening

1. Adopt Zero-Trust for Internal APIs: Remove implicit trust for internal network calls. Every request, even to internal endpoints, should carry an identity and be checked against an authorization policy independent of request content.
2. Fuzz Testing: Integrate API fuzzing (e.g., using schemathesis, Radamsa, or coverage-guided tools) into the CI/CD pipeline for Feast components to catch "missing field → default privileges" bugs before release.
3. Request Schema Enforcement: Enforce strict JSON Schema validation at the ingress layer, requiring feature_views to be a non-empty array. Reject requests that do not conform.
4. Monitor the Cloud: Set up anomaly detection on materialization job duration and resource usage. Sudden spikes in job execution — particularly full re-materializations — should alert SecOps.
5. Vendor Communication: Maintain a relationship with the Feast security team and subscribe to their security bulletins for early awareness of future flaws.

References

1. NVD Entry for CVE-2026-18947: https://nvd.nist.gov/vuln/detail/CVE-2026-18947
   (Primary source: vulnerability description, CVSS vector, patch claim)

2. Feast Official Documentation — Materialization: https://docs.feast.dev/reference/materialization
   (Overview of the materialization process and related endpoints for understanding the affected functionality — presented as background, not as a source of patched details)

3. Feast GitHub Repository / Security Advisories: https://github.com/feast-dev/feast/security/advisories
   (Check for a security advisory referencing CVE-2026-18947 and the confirmed patched version)

4. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/
   (Exploit Public-Facing Application — applicable to the external attack vector)

5. MITRE ATT&CK Technique T1499: https://attack.mitre.org/techniques/T1499/
   (Endpoint Denial of Service — applicable to the resource-exhaustion impact)

Threat Actor/Campaign Intelligence: As of the publication date, there is no publicly reported exploitation of CVE-2026-18947 in the wild, no CTI (cyber threat intelligence) reporting of campaigns targeting this flaw, and no evidence of inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog. The PoC/exploit status is None. The estimated CVSS of 8.5 and the ease of triggering (a crafted HTTP POST body) imply that exploitation is likely to be claimed by malicious actors quickly once vulnerable versions are correlated with the CVE. Organizations running Feast with exposed APIs are strongly advised to apply the mitigations without delay.

End of Report — Prepared by Valtersit Cyber Threat Intelligence Division, January 2026.