CVE-2026-23537: Jupyter unauth file write to RCE

CISO Take

The Feast Feature Server exposes a `/save-document` endpoint that lets anyone with network access write arbitrary JSON files to the server's filesystem, and the path restrictions meant to contain those writes can be bypassed — no credentials, no user interaction, CVSS 9.1. This matters because Feast sits in the ML pipeline feeding production models and is pulled in by 1,874 downstream dependents, and the affected products list includes Red Hat OpenShift AI's feature-server and workbench/pipeline-runtime images, so exposure isn't limited to standalone Feast deployments. There's no EPSS score, no CISA KEV listing, no public PoC, and no Nuclei template yet — this hasn't been weaponized in the wild as far as public data shows — but a missing-authorization bug (CWE-862) on a network-facing write endpoint is trivial to find and abuse once discovered. Patch to the fixed build referenced in the upstream PR immediately, and until patched, take the Feature Server off any network it doesn't need to be on and monitor its filesystem for unexpected writes to config or startup-script paths.

Sources: NVD CISA KEV access.redhat.com github.com OpenSSF ATLAS

What is the risk?

Critical on paper (CVSS 9.1, AV:N/AC:L/PR:N/UI:N) and the exploit path is conceptually trivial — an unauthenticated HTTP POST — but real-world risk is currently tempered by the absence of EPSS scoring, KEV listing, public exploit code, or a scanner template, meaning no confirmed active exploitation yet. The blast radius is large: 1,874 downstream dependents plus multiple Red Hat OpenShift AI images (feature-server, pipeline runtimes, Jupyter workbenches). The package's OpenSSF Scorecard of 5.8/10 and history of 26 prior CVEs suggest below-average security engineering maturity, which raises the odds of secondary bypasses even after this specific fix. Treat as high-priority patch-now given ease of exploitation and impact ceiling (RCE via startup script overwrite), even though exploitation-in-the-wild is currently unconfirmed.

How does the attack unfold?

Initial Access

Attacker locates a network-reachable Feast Feature Server and sends an unauthenticated POST request to the /save-document endpoint.

AML.T0049

Exploitation

A crafted filename/path in the JSON payload bypasses the server's location restrictions, allowing the write to land outside the intended directory, e.g. onto a config or startup script.

Impact

On the next service/container restart, the overwritten startup script executes attacker-controlled code (RCE), or repeated writes exhaust disk space and crash the feature-serving service (DoS).

AML.T0029

Initial Access

Attacker locates a network-reachable Feast Feature Server and sends an unauthenticated POST request to the /save-document endpoint.

AML.T0049

Exploitation

A crafted filename/path in the JSON payload bypasses the server's location restrictions, allowing the write to land outside the intended directory, e.g. onto a config or startup script.

Impact

On the next service/container restart, the overwritten startup script executes attacker-controlled code (RCE), or repeated writes exhaust disk space and crash the feature-serving service (DoS).

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter	pip	—	No patch
13.3K OpenSSF 5.8 1.9K dependents Pushed 4d ago 54% patched ~28d to patch Full package profile →
Jupyter	pip	—	No patch
13.3K OpenSSF 5.8 1.9K dependents Pushed 4d ago 54% patched ~28d to patch Full package profile →
Jupyter	pip	—	No patch
13.3K OpenSSF 5.8 1.9K dependents Pushed 4d ago 54% patched ~28d to patch Full package profile →
Jupyter	pip	—	No patch
13.3K OpenSSF 5.8 1.9K dependents Pushed 4d ago 54% patched ~28d to patch Full package profile →
Jupyter	pip	—	No patch
13.3K OpenSSF 5.8 1.9K dependents Pushed 4d ago 54% patched ~28d to patch Full package profile →
Jupyter	pip	—	No patch
13.3K OpenSSF 5.8 1.9K dependents Pushed 4d ago 54% patched ~28d to patch Full package profile →
Feast Feature Server	—	—	No patch
rhoai/odh-feature-server-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9	—	—	No patch
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

9.1 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I High

A High

What should I do?

1 step

1) Upgrade the Feast Feature Server to the fixed version referenced in github.com/red-hat-data-services/feast/pull/192 (and matching patched RHOAI images) as soon as it's available in your distro/registry. 2) Until patched, do not expose the Feature Server's HTTP API directly to untrusted networks — place it behind an authenticating reverse proxy or restrict to a private VPC/service mesh with mTLS. 3) Add a WAF/ingress rule to block or rate-limit POSTs to /save-document from outside expected service accounts. 4) Monitor filesystem integrity (e.g., auditd, FIM) on config directories and startup scripts used by the Feature Server container/host for unexpected JSON writes or modification timestamps. 5) Watch disk utilization on hosts running Feast for signs of write-flooding DoS. 6) Audit any RHOAI feature-server, pipeline-runtime, or Jupyter workbench images in use and schedule them for the same patch cycle.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution DoS API Training Data AML.T0010.001 - AI Software AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MANAGE 2.3 - Mechanisms for AI risk response, recovery, and incident handling

Frequently Asked Questions

What is CVE-2026-23537?

The Feast Feature Server exposes a `/save-document` endpoint that lets anyone with network access write arbitrary JSON files to the server's filesystem, and the path restrictions meant to contain those writes can be bypassed — no credentials, no user interaction, CVSS 9.1. This matters because Feast sits in the ML pipeline feeding production models and is pulled in by 1,874 downstream dependents, and the affected products list includes Red Hat OpenShift AI's feature-server and workbench/pipeline-runtime images, so exposure isn't limited to standalone Feast deployments. There's no EPSS score, no CISA KEV listing, no public PoC, and no Nuclei template yet — this hasn't been weaponized in the wild as far as public data shows — but a missing-authorization bug (CWE-862) on a network-facing write endpoint is trivial to find and abuse once discovered. Patch to the fixed build referenced in the upstream PR immediately, and until patched, take the Feature Server off any network it doesn't need to be on and monitor its filesystem for unexpected writes to config or startup-script paths.

Is CVE-2026-23537 actively exploited?

No confirmed active exploitation of CVE-2026-23537 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-23537?

1) Upgrade the Feast Feature Server to the fixed version referenced in github.com/red-hat-data-services/feast/pull/192 (and matching patched RHOAI images) as soon as it's available in your distro/registry. 2) Until patched, do not expose the Feature Server's HTTP API directly to untrusted networks — place it behind an authenticating reverse proxy or restrict to a private VPC/service mesh with mTLS. 3) Add a WAF/ingress rule to block or rate-limit POSTs to `/save-document` from outside expected service accounts. 4) Monitor filesystem integrity (e.g., auditd, FIM) on config directories and startup scripts used by the Feature Server container/host for unexpected JSON writes or modification timestamps. 5) Watch disk utilization on hosts running Feast for signs of write-flooding DoS. 6) Audit any RHOAI feature-server, pipeline-runtime, or Jupyter workbench images in use and schedule them for the same patch cycle.

What systems are affected by CVE-2026-23537?

This vulnerability affects the following AI/ML architecture patterns: feature stores, model serving pipelines, training pipelines, MLOps infrastructure.

What is the CVSS score for CVE-2026-23537?

CVE-2026-23537 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 0.65%.

What is the AI security impact?

Affected AI Architectures

feature storesmodel serving pipelinestraining pipelinesMLOps infrastructure

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling an attacker to overwrite vital application configurations or startup scripts. Because this flaw requires no credentials or special privileges, any attacker with network access to the server can potentially compromise the integrity of the system. This could lead to unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution.

Exploitation Scenario

An attacker scans internal or exposed network ranges for reachable Feast Feature Server instances (a common component in ML platforms and RHOAI deployments). Finding one, they send an unauthenticated POST to `/save-document` with a crafted JSON payload whose filename uses path-traversal or encoding tricks to escape the intended save directory — bypassing the server's location restrictions. The write lands on a container entrypoint script or application config file. On the next container restart (which the attacker may also trigger by flooding disk via repeated writes to force a crash-restart), the tampered script executes with the service's privileges, giving the attacker remote code execution inside the ML pipeline's infrastructure — a foothold that can pivot into training data, model artifacts, or downstream inference services.

Weaknesses (CWE)

CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.