CVE-2026-18947 in OpenShift AI
Summary
by MITRE • 08/10/2026
A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability under discussion affects the Feast machine learning feature store platform, specifically targeting authorization mechanisms within two critical endpoints. This authorization bypass flaw resides in the /materialize and /materialize-incremental API endpoints that govern how feature data is processed and made available for machine learning model training. The technical implementation fails to properly validate request parameters, creating a pathway for unauthorized access that violates fundamental security principles of least privilege and proper access control enforcement.
The core technical flaw manifests when an attacker crafts a request to these endpoints while deliberately omitting the feature_views field from the payload. This omission bypasses the intended permission validation checks that should verify whether the requesting entity has appropriate authorization to trigger materialization operations across feature views. The vulnerability stems from inadequate input validation and authorization logic, where the system assumes that any request containing certain fields automatically grants access rights regardless of the requester's authentication status or role within the system. This pattern aligns with CWE-285: Improper Authorization, which specifically addresses situations where systems fail to properly enforce access controls.
The operational impact of this vulnerability extends beyond simple unauthorized access to create significant business disruption through denial of service conditions. An attacker can trigger full re-materialization operations across all feature views within the system, consuming substantial computational resources and potentially corrupting data integrity. This affects multiple tenants simultaneously, creating cascading effects that can overwhelm system resources and render services unavailable to legitimate users. The attack vector is particularly dangerous because it requires minimal privileges - an unauthenticated attacker can exploit this vulnerability, or any authenticated user can leverage their existing credentials to cause similar disruption. This makes the vulnerability highly exploitable in environments where authentication mechanisms may be weak or where users have broad access rights.
The consequences of exploitation include substantial resource consumption through intensive data processing operations that can overwhelm system capacity and potentially corrupt feature store data. This type of denial of service attack directly impacts system availability and reliability, which are critical concerns for machine learning platforms that depend on consistent access to feature data. The vulnerability creates a scenario where legitimate users may experience degraded performance or complete unavailability of feature materialization services, impacting downstream machine learning workflows and model training processes. Organizations should implement immediate mitigations including strict input validation, enhanced authorization checks, and monitoring of these specific endpoints for suspicious activity patterns.
Security controls should focus on implementing comprehensive parameter validation that requires explicit verification of feature_views fields in all materialization requests regardless of authentication status. The system architecture must enforce mandatory authorization checks before allowing any materialization operations to proceed, ensuring that proper access control decisions are made based on user credentials and role assignments rather than request content alone. Additionally, rate limiting and resource consumption monitoring should be implemented at these endpoints to detect and prevent abuse patterns. This vulnerability demonstrates the importance of proper security design principles and continuous validation of access control mechanisms, particularly in distributed systems where multiple tenants share resources and require isolation from each other's operations. The ATT&CK framework would categorize this as a privilege escalation technique through improper authorization controls, potentially leading to resource exhaustion and service disruption attacks that can impact business continuity and data integrity across enterprise machine learning platforms.