CVE-2026-18948

Executive Summary

CVE-2026-18948 is a critical remote code execution vulnerability in Feast, an open-source feature store platform, arising from unsafe deserialization of user-defined functions (UDFs) serialized with the dill library and stored in the system registry. The flaw enables an unauthenticated remote attacker to achieve arbitrary code execution on the feature server in default configurations, while an authenticated attacker can bypass authorization checks to achieve code execution on the registry server — both with potential for cross-tenant data access and lateral movement. With a CVSS score of 9.9 and no patch available, Feast deployments are at immediate risk of full compromise.

Technical Analysis

The root cause of CVE-2026-18948 lies in Feast's use of the dill serialization library to persist user-defined functions (UDFs) within its registry infrastructure. The dill library extends Python's pickle protocol and is capable of serializing a broader range of Python objects — including lambdas, closures, and complex objects. However, like pickle, dill is fundamentally unsafe when used to deserialize data from untrusted sources. Deserializing a crafted dill payload can result in arbitrary code execution on the target process, as the deserialization process can invoke arbitrary Python callables during object reconstruction.

The vulnerability manifests in two distinct attack surfaces:

1. Feature Server (Unauthenticated RCE): In default configurations, the Feast feature server deserializes UDFs retrieved from the registry. Because registry access is not gated behind authentication in these default deployments, a remote attacker can upload or inject a malicious UDF into the registry. When the feature server subsequently loads and deserializes the UDF for execution, the malicious payload executes in the context of the feature server process. This leads to unauthenticated arbitrary code execution — a critical flaw given the network-facing nature of feature servers.

2. Registry Server (Authenticated RCE via Authorization Bypass): The second attack vector targets the registry server itself. An authenticated user can craft a malicious UDF that, upon deserialization, bypasses the authorization checks embedded in Feast's deserialization logic. This suggests the deserialization process occurs before (or independent of) the proper permission verification, allowing a low-privileged authenticated user to escalate to code execution on the registry server.

The underlying vulnerability class is CWE-502 (Deserialization of Untrusted Data), though the NVD entry does not explicitly list a CWE. The attack surface includes any API endpoint, CLI interface, or administrative function that allows UDF registration or registry modification. The registry server and feature servers are both affected, representing the core operational components of a Feast deployment.

Exploitation Scenarios

No public PoC or exploit code is currently available; the attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification: An attacker begins by scanning for exposed Feast infrastructure. Feast deployments commonly expose REST/gRPC endpoints for feature retrieval (feature server) and registry management services. Network-accessible feature server ports and any unauthenticated registry service endpoints are prime targets. In cloud environments, misconfigured security groups or Kubernetes ingress rules may expose these services beyond the intended internal network boundary. Shodan-style queries for Feast-specific service banners or API fingerprints would aid discovery.

Step 2 — Vulnerability Class Triggering: For the unauthenticated vector, the attacker interacts with the registry's API to store a new UDF. Because the registry accepts UDF definitions serialized with dill, the attacker crafts a malicious serialized payload. The registry service may not validate the content of the UDF beyond basic schema checks, storing the payload for later retrieval. On the feature server side, the attacker (or a legitimate user) triggers feature retrieval that causes the server to load the stored UDF from the registry. The server deserializes the UDF using dill, and the malicious payload executes during the deserialization process.

For the authenticated vector, the attacker authenticates with low-privileged credentials (e.g., a read-only user) and submits a crafted UDF to the registry server. The deserialization flaw allows the payload to execute before or without proper authorization context enforcement, bypassing any role-based access control intended to restrict UDF registration or execution.

Step 3 — Payload / Execution Method: The malicious dill payload is constructed to execute arbitrary Python code during deserialization. Common techniques include leveraging __reduce__ methods or other object reconstruction hooks that invoke system commands via os.system, subprocess.Popen, or by evaluating embedded bytecode. The payload can be designed to spawn a reverse shell, write a web shell to disk, or drop a persistence mechanism such as a cron job or systemd service.

Step 4 — Post-Exploitation Impact: Successful exploitation grants the attacker code execution in the context of:

• Feature server process: Likely a service account with access to feature store data, database credentials, and potentially broader cloud metadata (e.g., AWS IAM role credentials via IMDS).
• Registry server process: Access to the registry database, all stored UDFs, feature definitions, and potentially other tenants' data in a multi-tenant deployment.

From either foothold, the attacker can perform cross-tenant data access, exfiltrate feature data, pivot to connected databases and data warehouses, and move laterally to other systems within the network. The scope (S:C in the CVSS vector) confirms that a successful exploit compromises resources beyond the directly vulnerable component.

Impact Assessment

The CVSS v3.1 score of 9.9 (Critical) reflects the severity of this vulnerability:

• Attack Vector: Network (AV:N) — remotely exploitable
• Attack Complexity: Low (AC:L) — no special conditions required
• Privileges Required: Low (PR:L) — for the registry server vector; note the feature server vector is unauthenticated, making it even more severe than the CVSS vector indicates
• User Interaction: None (UI:N) — no victim action required
• Scope: Changed (S:C) — compromise extends beyond the vulnerable component
• Confidentiality/Integrity/Availability Impact: High/High/High — full compromise

Business Impact:

• Data Breach: Feature stores contain sensitive business data (user behavior, transaction features, ML model inputs). Full database access via RCE enables mass data exfiltration.
• Multi-Tenant Compromise: In SaaS or shared Feast deployments, cross-tenant data access can expose one customer's data to another — a severe regulatory and reputational risk.
• Model Integrity: Attackers could modify UDFs to alter feature computation, poisoning ML models and degrading model accuracy or introducing backdoors in decision-making systems.
• Lateral Movement: The scope change indicates the attacker can pivot from the feature server to other internal systems, potentially reaching core production databases or CI/CD pipelines.

Affected Systems: All Feast deployments that use the registry to store UDFs and deserialize them via dill. This is the default configuration. No specific version list is available, but the vulnerability is systemic to Feast's architecture.

Detection Guidance

Sigma Rule

title: Feast Unsafe Dill Deserialization - Suspicious UDF Registration
id: 8a7c3e5f-9b1d-4e6a-8f2c-5d1b7a3e9c4f
status: experimental
description: Detects attempts to register or retrieve UDFs in Feast with suspicious serialized payload characteristics, potentially indicating exploitation of CVE-2026-18948 (unsafe dill deserialization).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18948
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
    - attack.t1210
    - attack.execution
    - cve.2026.18948
logsource:
    category: application
    product: feast
detection:
    selection_udf_request:
        cs-method: POST
        cs-uri-query|contains:
            - 'udf'
            - 'function'
            - 'registry'
    selection_suspicious_payload:
        cs-body|contains|all:
            - 'dill'
            - '__reduce__'
            - 'subprocess'
            - 'os.system'
            - 'eval'
            - 'exec'
    condition: selection_udf_request and selection_suspicious_payload
falsepositives:
    - Legitimate UDF registration that happens to contain serialization-related keywords
level: high

YARA Rule

rule CVE_2026_18948_Feast_Dill_UDF_Payload
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious dill-serialized payloads associated with CVE-2026-18948, targeting Feast UDF registry deserialization."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18948"
        date = "2026-01-15"
        cve = "CVE-2026-18948"
        score = 85

    strings:
        $dill_magic = { 80 04 95 }  // dill/pickle PROTO + STACK_GLOBAL magic bytes
        $reduce_ref = "__reduce__"
        $os_system = "os.system"
        $subprocess = "subprocess"
        $popen = "Popen"
        $eval_ref = "eval("
        $exec_ref = "exec("
        $base64_payload = "base64"
        $reverse_shell = "socket"
        $curl_wget = /(curl|wget)\s+http/

    condition:
        uint32(0) == 0x04008006 or // dill header variation
        ($dill_magic and 2 of ($reduce_ref, $os_system, $subprocess, $popen, $eval_ref, $exec_ref)) or
        ($dill_magic and ($base64_payload or $reverse_shell or $curl_wget))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-18948 Feast UDF Registry Dill Deserialization Attempt"; flow:established,to_server; content:"POST"; http_method; content:"udf"; http_uri; nocase; content:"dill"; http_client_body; nocase; content:"__reduce__"; http_client_body; nocase; content:"os.system"; http_client_body; nocase; reference:cve,2026-18948; classtype:attempted-admin; sid:202618948001; rev:1;)

Elastic Detection

// Detect Feast registry UDF registration with suspicious payload characteristics
sequence by process.entity_id
  [ network where event.type == "start" and destination.port in (8080, 6565, 8890) ]
  [ process where event.action == "executed" and 
      (process.args : "*dill*" or process.args : "*registry*") ]
  [ file where event.action == "written" and 
      file.name : "*.udf" and 
      process.args : "*feast*" ]

// Detect deserialization-related code execution after UDF processing
sequence with maxspan=15s
  [ process where event.action == "executed" and 
    process.args : "*f*" and process.code_signature.status : "unsigned" ]
  [ process where event.type == "start" and 
      (process.args : "*bash*" or process.args : "*sh*" or process.args : "*python*" -c*) ]

// Detect suspicious commands executed by feast server process
process where event.type == "start" and 
  process.parent.name : ("python*", "feast*") and 
  process.name : ("sh", "bash", "curl", "wget", "nc", "python") and 
  process.args : ("-c", "-e", "http*", "*.sh*")

Splunk SPL Query

index=* sourcetype="feast:audit" OR sourcetype="feast:server"
| where like(_raw, "%udf%") OR like(_raw, "%dill%") OR like(_raw, "%deserialize%")
| regex _raw="(?i)(__reduce__|os\.system|subprocess|Popen|eval\(|exec\()"
| table _time, src_ip, service_name, endpoint, message
| sort -_time
| stats count by src_ip, service_name

index=* sourcetype="feast:registry" 
| regex _raw="(?i)(unauthorized|permission denied|forbidden)"
| table _time, user, source_address, endpoint, response_code
| eventstats count as failed_attempts by user
| where failed_attempts > 10

Wazuh OSSEC Rule

<group name="feast,cve-2026-18948,">
    <!-- Detect suspicious UDF registration on Feast registry -->
    <rule id="100234" level="15">
        <if_sid>100200</if_sid>  <!-- Parent rule for feast registry logs -->
        <match>udf</match>
        <regex>dill|__reduce__|os\.system|subprocess|eval\(|exec\(</regex>
        <description>CVE-2026-18948: Suspicious UDF registration detected on Feast registry server, possible dill deserialization exploitation.</description>
        <group>attacker,exploitation,</group>
        <mitre>
            <id>T1210</id>
        </mitre>
    </rule>

    <!-- Detect high-volume failed auth attempts on Feast registry -->
    <rule id="100235" level="8" frequency="10" timeframe="60">
        <if_matched_sid>100234</if_matched_sid>
        <match>permission denied|unauthorized</match>
        <description>CVE-2026-18948: Repeated authorization bypass attempts on Feast registry, potential exploitation activity.</description>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. Feast maintainers have not released an official fix, and no vendor advisory has been published.

1. Immediate Mitigations:

• Disable or restrict UDF registration: If possible, disable dynamic UDF registration entirely or restrict it to a shortlist of trusted administrators. Use network rules (firewall, security groups, Kubernetes NetworkPolicies) to block external access to registry server endpoints.
• Authenticate all registry access: Ensure that the Feast registry is not accessible without authentication. If Feast's default configuration does not enforce authentication, place it behind a reverse proxy or API gateway that enforces strong auth (e.g., mTLS, OAuth2) and rate limiting.
• Isolate feature server from registry: If UDFs are not required for core feature retrieval, consider separating the registry from feature servers so that a malicious UDF stored in the registry is not automatically pulled and deserialized by feature-serving processes.
• Deploy in read-only model: Configure registry storage as read-only for non-admin users. If the registry is backed by a database, grant the application user SELECT-only privileges and manage UDF registration through a controlled, reviewed process.

2. Patch / Upgrade Steps:

• No patch is currently available. Monitor the Feast GitHub repository and the project's official security channels for announcements.
• Until a patch is released, do not upgrade to a "fixed" version — one does not exist. Verify on premise that any Feast version used is still the latest stable release with all other security patches applied.

3. Long-Term Hardening:

• Replace dill serialization: Advocate for and implement (or fork) Feast to use a safe serialization format for UDFs, such as JSON it with explicit allowlist-based function references, or use pickle-safe serialization with cryptographic signature verification.
• Code signing for UDFs: Require all UDFs to be digitally signed by authorized keys and verify signatures before deserialization.
• Sandboxing: Run feature servers and registry servers inside container runtimes with seccomp profiles, AppArmor/SELinux policies, and minimal privilege service accounts. Consider gVisor or Firecracker microVMs for stronger isolation.
• Network segmentation: Place Feast behind internal firewalls with strict egress controls. Restrict outbound internet access from Feast components to prevent reverse-shell callbacks.
• Monitoring: Implement the detection rules above and integrate them into the enterprise SIEM. Enable full audit logging on Feast components, capturing all registry operations, UDF registrations, and authentication events.
• Incident Response: Assume compromise if any suspicious UDF registration or unexplained execution from Feast processes is observed. Treat the feature store as a high-value asset and isolate it accordingly.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18948
2. Feast Official Project: https://feast.dev/
3. Feast GitHub Repository: https://github.com/feast-dev/feast
4. CWE-502 (Deserialization of Untrusted Data): https://cwe.mitre.org/data/definitions/502.html
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-18948 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence have been reported as of the time of writing. Due to the critical severity and lack of patch, this advisory should be treated with the highest priority. The absence of public exploit code does not diminish the risk; private exploit development is likely underway given the clarity of the vulnerability mechanism.