CVE-2026-18947: TensorFlow authz bypass

CISO Take

Feast's /materialize and /materialize-incremental endpoints skip their permission checks whenever the feature_views field is omitted from the request, letting an unauthenticated or low-privileged user force a full re-materialization of every feature view in the deployment. With 3,744 downstream dependents and no authentication required for the worst-case path, the blast radius spans any organization running Feast as a shared, multi-tenant feature store — a single crafted request can corrupt feature data and exhaust compute across every tenant sharing that instance. Exploitation likelihood is currently low (EPSS 0.432%, top 64th percentile; no public PoC, no Nuclei template, not in CISA KEV, SSVC rated TRACK), but the trivial exploitation bar — a malformed HTTP request with no special tooling — means this could be weaponized quickly if attention shifts to it. Prioritize patching per the Red Hat advisories (RHSA-2026:53263, RHSA-2026:53261) or applying strict request validation/WAF rules on the materialize endpoints in the interim, and monitor for materialization jobs triggered without an explicit feature_views scope as a detection signal.

Sources: NVD EPSS access.redhat.com ATLAS OpenSSF

What is the risk?

CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L) reflects a network-exploitable, low-complexity flaw with a scope change — the authorization bypass affects resources beyond the vulnerable component (all tenants' feature views). No confidentiality impact, but high integrity impact (data corruption from uncontrolled re-materialization) and availability degradation from resource exhaustion. Real-world exploitation signals are currently weak: EPSS is low (0.432%), there's no CISA KEV listing, no public exploit or scanner template, and CISA's SSVC decision is TRACK (lowest urgency tier). However, the package itself carries elevated background risk — 437 other CVEs in the same package and an OpenSSF Scorecard of 7.4/10 — and the attack requires no authentication in the unauthenticated-attacker case, so exposure in multi-tenant or externally reachable Feast deployments should be treated as meaningfully higher than the raw EPSS score suggests.

How does the attack unfold?

Initial Access

Attacker sends a crafted POST request to Feast's /materialize or /materialize-incremental endpoint, deliberately omitting the feature_views field.

AML.T0049

Authorization Bypass

The missing feature_views field causes Feast's permission-check logic to be skipped, allowing an unauthenticated or low-privileged caller to invoke the endpoint with full scope.

Impact

Feast triggers a full re-materialization of all feature views across all tenants, corrupting feature data and consuming significant shared compute resources, resulting in a denial of service.

AML.T0059

Initial Access

Attacker sends a crafted POST request to Feast's /materialize or /materialize-incremental endpoint, deliberately omitting the feature_views field.

AML.T0049

Authorization Bypass

The missing feature_views field causes Feast's permission-check logic to be skipped, allowing an unauthenticated or low-privileged caller to invoke the endpoint with full scope.

Impact

Feast triggers a full re-materialization of all feature views across all tenants, corrupting feature data and consuming significant shared compute resources, resulting in a denial of service.

AML.T0059

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
TensorFlow	pip	—	No patch
200.5K OpenSSF 7.5 3.4K dependents Pushed 5d ago 4% patched ~1372d to patch Full package profile →
TensorFlow	pip	—	No patch
200.5K OpenSSF 7.5 3.4K dependents Pushed 5d ago 4% patched ~1372d to patch Full package profile →
TensorFlow	pip	—	No patch
200.5K OpenSSF 7.5 3.4K dependents Pushed 5d ago 4% patched ~1372d to patch Full package profile →
TensorFlow	pip	—	No patch
200.5K OpenSSF 7.5 3.4K dependents Pushed 5d ago 4% patched ~1372d to patch Full package profile →
rhoai/odh-feature-server-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9	—	—	No patch
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9	—	—	No patch
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9	—	—	No patch
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9	—	—	No patch
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9	—	—	No patch
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

8.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C None

I High

A Low

What should I do?

1 step

Apply the vendor-provided fix referenced in RHSA-2026:53263 and RHSA-2026:53261 as soon as it's validated in your environment. Until patched, restrict network access to /materialize and /materialize-incremental to trusted internal callers only (no public exposure), and add request-level validation (WAF/API gateway rule) that rejects materialize requests missing the feature_views field rather than allowing them to silently succeed with expanded scope. For detection, alert on materialization jobs that touch an unusually broad set of feature views relative to the requesting user's normal scope, and monitor Feast job logs/metrics for spikes in concurrent materialization runs or unexpected full-catalog jobs. In multi-tenant deployments, consider network-level tenant isolation for the materialize API as a compensating control.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Training Data API AML.T0034.001 - Resource-Intensive Queries AML.T0049 - Exploit Public-Facing Application AML.T0059 - Erode Dataset Integrity

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.7.2 - Data for AI systems

NIST AI RMF

MANAGE 2.3 - AI system risks and benefits are regularly monitored, and mechanisms for surfacing and responding to negative impacts are in place

Frequently Asked Questions

What is CVE-2026-18947?

Feast's /materialize and /materialize-incremental endpoints skip their permission checks whenever the feature_views field is omitted from the request, letting an unauthenticated or low-privileged user force a full re-materialization of every feature view in the deployment. With 3,744 downstream dependents and no authentication required for the worst-case path, the blast radius spans any organization running Feast as a shared, multi-tenant feature store — a single crafted request can corrupt feature data and exhaust compute across every tenant sharing that instance. Exploitation likelihood is currently low (EPSS 0.432%, top 64th percentile; no public PoC, no Nuclei template, not in CISA KEV, SSVC rated TRACK), but the trivial exploitation bar — a malformed HTTP request with no special tooling — means this could be weaponized quickly if attention shifts to it. Prioritize patching per the Red Hat advisories (RHSA-2026:53263, RHSA-2026:53261) or applying strict request validation/WAF rules on the materialize endpoints in the interim, and monitor for materialization jobs triggered without an explicit feature_views scope as a detection signal.

Is CVE-2026-18947 actively exploited?

No confirmed active exploitation of CVE-2026-18947 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-18947?

Apply the vendor-provided fix referenced in RHSA-2026:53263 and RHSA-2026:53261 as soon as it's validated in your environment. Until patched, restrict network access to /materialize and /materialize-incremental to trusted internal callers only (no public exposure), and add request-level validation (WAF/API gateway rule) that rejects materialize requests missing the feature_views field rather than allowing them to silently succeed with expanded scope. For detection, alert on materialization jobs that touch an unusually broad set of feature views relative to the requesting user's normal scope, and monitor Feast job logs/metrics for spikes in concurrent materialization runs or unexpected full-catalog jobs. In multi-tenant deployments, consider network-level tenant isolation for the materialize API as a compensating control.

What systems are affected by CVE-2026-18947?

This vulnerability affects the following AI/ML architecture patterns: feature stores, training pipelines, model serving, MLOps pipelines.

What is the CVSS score for CVE-2026-18947?

CVE-2026-18947 has a CVSS v3.1 base score of 8.5 (HIGH). The EPSS exploitation probability is 0.59%.

What is the AI security impact?

Affected AI Architectures

feature storestraining pipelinesmodel servingMLOps pipelines

MITRE ATLAS Techniques

AML.T0034.001 Resource-Intensive Queries

AML.T0049 Exploit Public-Facing Application

AML.T0059 Erode Dataset Integrity

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.2

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.

Exploitation Scenario

An attacker with network access to a Feast deployment's API — potentially without any credentials if the deployment is unauthenticated, or with only low-privilege access otherwise — sends a POST request to /materialize (or /materialize-incremental) that deliberately omits the feature_views parameter. Because the permission-check logic assumes feature_views is always present to scope the authorization decision, its absence causes the check to be skipped entirely rather than fail-closed. The request is accepted and Feast kicks off a full re-materialization across all feature views for all tenants, consuming shared compute and storage resources and potentially corrupting feature data mid-flight if concurrent materialization jobs collide — degrading or corrupting the features multiple downstream ML models depend on for inference.