CVE-2026-23538: Jupyter unauth WebSocket connections

CISO Take

Feast Feature Server's /ws/chat endpoint accepts unlimited WebSocket connections from anyone on the network without authentication or per-connection resource limits, letting an attacker exhaust memory, CPU, or file descriptors and take the service offline. This matters because Feast sits in the feature-serving path for production ML pipelines — with 1,876 downstream dependents, an outage here doesn't just kill a chat widget, it starves any model inference that depends on real-time feature lookups, and the flaw ships in Red Hat OpenShift AI's pipeline-runtime and workbench images used across CUDA, ROCm, and CPU deployments. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks unweaponized today, but the attack needs zero privileges, zero user interaction, and only network access (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N) — trivial to script with a basic connection-flood tool. No patched version is listed yet, so track the fix at https://github.com/red-hat-data-services/feast/pull/192 and the Red Hat advisory, and in the meantime front the endpoint with an authenticating reverse proxy plus per-IP connection-rate and concurrency caps, alerting on abnormal spikes in open WebSocket counts on the feature server.

Sources: NVD GitHub Advisory access.redhat.com OpenSSF ATLAS

What is the risk?

High exploitability, low-severity blast radius: the attack path requires no authentication, no user interaction, and low complexity (AV:N/AC:L/PR:N/UI:N), so any network-reachable attacker can trigger it with commodity flooding tools — CWE-770 (missing resource allocation limits) is the textbook root cause. Impact is confined to availability (C:N/I:N/A:H) with no data confidentiality or integrity loss, which caps the CVSS at 7.5 rather than critical. Real-world risk is currently moderated by the absence of EPSS scoring, CISA KEV inclusion, a public PoC, or a Nuclei template — nothing suggests active or imminent mass exploitation — but the combination of zero-auth network exposure and a widely-deployed feature-serving component (1,876 dependents, present in Red Hat OpenShift AI images) means any internet- or intranet-exposed deployment should be treated as an immediate hardening priority rather than a backlog item.

How does the attack unfold?

Initial Access

Attacker locates the network-exposed, unauthenticated /ws/chat WebSocket endpoint on a Feast Feature Server.

AML.T0049

Resource Exhaustion

Attacker scripts the opening of a large number of simultaneous WebSocket connections with no credentials required, consuming server memory, CPU, and file descriptors.

AML.T0029

Impact

The Feature Server becomes unresponsive or crashes, denying legitimate feature-serving requests and disrupting any dependent training, batch scoring, or inference pipelines.

AML.T0029

Initial Access

Attacker locates the network-exposed, unauthenticated /ws/chat WebSocket endpoint on a Feast Feature Server.

AML.T0049

Resource Exhaustion

Attacker scripts the opening of a large number of simultaneous WebSocket connections with no credentials required, consuming server memory, CPU, and file descriptors.

AML.T0029

Impact

The Feature Server becomes unresponsive or crashes, denying legitimate feature-serving requests and disrupting any dependent training, batch scoring, or inference pipelines.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter	pip	—	No patch
13.3K OpenSSF 5.7 1.9K dependents Pushed 2d ago 57% patched ~35d to patch Full package profile →
Jupyter	pip	—	No patch
13.3K OpenSSF 5.7 1.9K dependents Pushed 2d ago 57% patched ~35d to patch Full package profile →
Jupyter	pip	—	No patch
13.3K OpenSSF 5.7 1.9K dependents Pushed 2d ago 57% patched ~35d to patch Full package profile →
Jupyter	pip	—	No patch
13.3K OpenSSF 5.7 1.9K dependents Pushed 2d ago 57% patched ~35d to patch Full package profile →
Jupyter	pip	—	No patch
13.3K OpenSSF 5.7 1.9K dependents Pushed 2d ago 57% patched ~35d to patch Full package profile →
Jupyter	pip	—	No patch
13.3K OpenSSF 5.7 1.9K dependents Pushed 2d ago 57% patched ~35d to patch Full package profile →
Feast Feature Server	—	—	No patch
rhoai/odh-feature-server-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9	—	—	No patch
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9	—	—	No patch
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 58% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

No patched version is published yet — monitor https://github.com/red-hat-data-services/feast/pull/192 and https://access.redhat.com/security/cve/CVE-2026-23538 for a fix and apply it as soon as it ships. Until then, do not expose /ws/chat directly to untrusted networks: place it behind a reverse proxy or API gateway that enforces authentication before the WebSocket upgrade completes. Apply connection-rate and per-IP concurrency limits at the ingress/load-balancer layer (e.g., nginx limit_conn, Envoy connection limits, cloud WAF rate rules) and set server-side caps on total open WebSocket connections and per-connection idle timeouts. For detection, alert on abnormal growth in open file descriptors, memory, or concurrent WebSocket sessions on the Feature Server process, and log/alert on connection bursts from a single source IP or ASN. In RHOAI deployments, restrict network policies so pipeline-runtime and workbench images cannot reach the feature server's chat endpoint from outside the cluster's trusted namespaces.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Auth Bypass Framework Inference AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MANAGE 2.3 - Mechanisms for AI system availability and resilience

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-23538?

Feast Feature Server's /ws/chat endpoint accepts unlimited WebSocket connections from anyone on the network without authentication or per-connection resource limits, letting an attacker exhaust memory, CPU, or file descriptors and take the service offline. This matters because Feast sits in the feature-serving path for production ML pipelines — with 1,876 downstream dependents, an outage here doesn't just kill a chat widget, it starves any model inference that depends on real-time feature lookups, and the flaw ships in Red Hat OpenShift AI's pipeline-runtime and workbench images used across CUDA, ROCm, and CPU deployments. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks unweaponized today, but the attack needs zero privileges, zero user interaction, and only network access (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N) — trivial to script with a basic connection-flood tool. No patched version is listed yet, so track the fix at https://github.com/red-hat-data-services/feast/pull/192 and the Red Hat advisory, and in the meantime front the endpoint with an authenticating reverse proxy plus per-IP connection-rate and concurrency caps, alerting on abnormal spikes in open WebSocket counts on the feature server.

Is CVE-2026-23538 actively exploited?

No confirmed active exploitation of CVE-2026-23538 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-23538?

No patched version is published yet — monitor https://github.com/red-hat-data-services/feast/pull/192 and https://access.redhat.com/security/cve/CVE-2026-23538 for a fix and apply it as soon as it ships. Until then, do not expose /ws/chat directly to untrusted networks: place it behind a reverse proxy or API gateway that enforces authentication before the WebSocket upgrade completes. Apply connection-rate and per-IP concurrency limits at the ingress/load-balancer layer (e.g., nginx limit_conn, Envoy connection limits, cloud WAF rate rules) and set server-side caps on total open WebSocket connections and per-connection idle timeouts. For detection, alert on abnormal growth in open file descriptors, memory, or concurrent WebSocket sessions on the Feature Server process, and log/alert on connection bursts from a single source IP or ASN. In RHOAI deployments, restrict network policies so pipeline-runtime and workbench images cannot reach the feature server's chat endpoint from outside the cluster's trusted namespaces.

What systems are affected by CVE-2026-23538?

This vulnerability affects the following AI/ML architecture patterns: feature stores, model serving, MLOps pipelines, training pipelines.

What is the CVSS score for CVE-2026-23538?

CVE-2026-23538 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.89%.

What is the AI security impact?

Affected AI Architectures

feature storesmodel servingMLOps pipelinestraining pipelines

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory, CPU, and file descriptors—leading to a complete denial of service for legitimate users.

Exploitation Scenario

An attacker identifies a Feast Feature Server exposed on a corporate network or misconfigured public endpoint (e.g., via port/service scanning or leaked deployment configs) and locates the /ws/chat WebSocket route. Using a simple script or off-the-shelf flooding tool, they open thousands of concurrent WebSocket connections without ever needing credentials, since the endpoint performs no authentication check. As connections accumulate, the server's memory, CPU, and file-descriptor limits are exhausted, causing the Feature Server to slow to a crawl or crash outright. Any ML models, agents, or applications that depend on that Feature Server for real-time feature retrieval start failing or timing out, producing a denial-of-service that can ripple through training jobs, batch scoring, and live inference pipelines running on top of the same Red Hat OpenShift AI environment — all without the attacker needing any AI/ML-specific knowledge.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.