CVE-2026-18948: Feast: insecure UDF deserialization enables RCE

Feast, an open-source feature store used to serve real-time features to production ML models, deserializes user-defined functions (UDFs) with Python's dill library — functionally equivalent to unpickling attacker-controlled data — allowing arbitrary code execution the moment the feature server loads a malicious UDF, with no authentication required in the default configuration. This isn't a niche package: it has 3,744 downstream dependents and ships baked into 14 Red Hat OpenShift AI (RHOAI) container images spanning feature servers, pipeline runtimes (PyTorch, TensorFlow), and Jupyter workbenches, so the exposure extends well beyond teams who consciously chose Feast. Current exploitation signals are low — EPSS sits at 0.69%, there's no public PoC or Nuclei template, it's not in CISA KEV, and CISA's own SSVC decision is TRACK (lowest urgency) — but the CVSS 9.9 score, unauthenticated network-exploitable RCE, and cross-tenant lateral movement potential in shared MLOps clusters make this a priority patch rather than a monitor-and-wait item. Apply the Red Hat errata (RHSA-2026:53261/53262/53263) for affected RHOAI images now, and in the interim block network access to feature servers and lock down who can write UDFs to the registry.

No confirmed active exploitation of CVE-2026-18948 has been reported, but organizations should still patch proactively.

Patch: apply the relevant Red Hat errata (RHSA-2026:53261, RHSA-2026:53262, RHSA-2026:53263) for affected RHOAI container images immediately; non-Red Hat Feast deployments should track upstream Feast release notes for the equivalent fix. Workaround: never expose feature servers directly to untrusted networks — require authentication/mTLS in front of them even though the app itself doesn't enforce it by default; restrict UDF registration and registry write access to a tightly-controlled, trusted set of service accounts; review registry authorization logic for the bypass path described in the advisory. Detection: audit the Feast registry for UDFs registered by unexpected principals or outside normal CI/CD workflows; monitor feature-server processes for unexpected child processes or outbound network connections consistent with a reverse shell; inventory RHOAI image versions across clusters and flag any pre-patch tags. Longer term: evaluate replacing dill/pickle-based UDF serialization with a safe, non-executable format, or run UDF deserialization in a sandboxed/isolated execution context.

This vulnerability affects the following AI/ML architecture patterns: feature stores, MLOps pipelines, model serving, training pipelines, multi-tenant ML platforms.

CVE-2026-18948 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 1.08%.