CVE-2026-56121 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-56121 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-56121 is a critical remote code execution flaw in Feast before 0.63.0 with a CVSS 9.8 score. A crafted gRPC request to the registry server can trigger unsafe deserialization of user_defined_function.body in an OnDemandFeatureView spec before authorization checks run. In practical terms, an unauthenticated or unauthorized attacker may be able to execute OS commands as the Feast service account.

This is especially dangerous for solo developers and small teams because the blast radius can include feature stores, internal data pipelines, secrets accessible to the service account, and any network resources the server can reach. There is no known exploitation in the wild yet, and it is not currently in CISA KEV, but the exposure is severe enough to treat as an emergency.

Immediate Action

  • Upgrade Feast immediately to 0.63.0 or later. If you cannot patch within hours, take the registry server offline or isolate it behind internal-only network controls.
  • Block unauthenticated gRPC access to the registry server at the firewall, load balancer, or service mesh. Only allow trusted admin networks until patched.
  • Roll back any recent Feast registry exposure to public endpoints. If the service must remain up, restrict it to a private subnet and require mTLS or equivalent auth.
  • Rotate credentials used by the Feast service account after patching, especially if the server was reachable from untrusted networks.
  • Review vendor guidance and release notes for Feast vendor advisory / release notes.

Affected Versions

  • feast<0.63.0 vulnerable; upgrade to feast@0.63.0 or later.
  • feast==0.62.x and earlier vulnerable; no safe 0.62.x release is indicated.
  • feast>=0.63.0 considered safe based on the provided advisory context.

Resolution Guide

Python / pip

python -m pip install --upgrade "feast>=0.63.0"
python -m pip show feast

pipx

pipx upgrade feast
pipx list | grep feast

JavaScript package managers Feast is not typically installed via npm/yarn/pnpm, but if your deployment wraps it in tooling or containers, update the image or lockfile to the patched Feast version.

# npm
npm i feast@0.63.0

# yarn
yarn add feast@0.63.0

# pnpm
pnpm add feast@0.63.0

Java / Maven / Gradle If Feast is consumed indirectly in a Java-based platform or container image, update the underlying service image or dependency bundle to the patched release.

# Maven (placeholder if Feast is vendored in a custom artifact)
mvn versions:use-latest-releases -Dincludes=feast:feast

# Gradle
./gradlew dependencies --configuration runtimeClasspath

Linux package managers If you deploy Feast from a distro package, update to the vendor package that includes 0.63.0 or later.

# apt
sudo apt-get update
sudo apt-get install --only-upgrade feast

# yum/dnf
sudo yum update feast
sudo dnf update feast

Docker

# Replace TODO with the patched image tag used by your deployment
docker pull feastproject/feast:0.63.0
docker run --rm feastproject/feast:0.63.0 --version

Config hardening

# Example: restrict registry exposure at the network layer
# Allow only internal admin subnet, block public ingress

# Example: if your deployment supports disabling registry write paths,
# disable them until patched (placeholder setting names)
FEAST_REGISTRY_READ_ONLY=true
FEAST_DISABLE_ONDEMAND_FEATURE_VIEW_UPLOAD=true

Code fix example If you maintain a fork or downstream patch, the safe pattern is to authenticate and authorize before any deserialization, and to avoid dill.loads() on untrusted input.

# Pseudocode patch example
def handle_request(request, user):
    authorize(user, "registry.write")  # do this first
    raw = base64.b64decode(request.user_defined_function.body)

    # Prefer a safe serializer or strict schema validation
    # Avoid dill.loads(raw) on attacker-controlled bytes
    udf = validate_udf_payload(raw)
    return store_udf(udf)

Detection & Verification

Check installed version

python -m pip show feast
python -c "import feast; print(feast.__version__)"

Search for vulnerable code paths

grep -R "dill.loads" -n .
grep -R "user_defined_function.body" -n .
grep -R "OnDemandFeatureView" -n .

Audit dependencies

python -m pip install pip-audit
pip-audit | grep feast

Container verification

docker image inspect feastproject/feast:0.63.0 --format '{{.RepoTags}}'
docker run --rm feastproject/feast:0.63.0 python -c "import feast; print(feast.__version__)"

Confirm the fix

# Expect 0.63.0 or newer
python -c "import feast; assert tuple(map(int, feast.__version__.split('.'))) >= (0, 63, 0); print('patched')"

Risk and Impact

Successful exploitation can give an attacker arbitrary command execution as the Feast service account, which may expose secrets, internal datasets, model artifacts, and cloud credentials. Because the flaw is triggered by a crafted gRPC request, any reachable registry server is a potential target, including small self-hosted deployments with minimal perimeter controls. If the service account has broad permissions, the attacker may pivot into storage, CI/CD, or adjacent infrastructure.

Bottom line: patch to 0.63.0 or later now, isolate the registry server until you do, and rotate credentials if the service was exposed.

Keep reading