Feast /materialize Auth Bypass Enables DoS
CVE-2026-18947 Published on August 10, 2026
Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization
A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.
Vulnerability Analysis
CVE-2026-18947 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and a small impact on availability.
Timeline
Reported to Red Hat.
Made public. 6 days later.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-18947 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-18947
Want to know whenever a new CVE is published for Red Hat Openshift Ai? stack.watch will email you.
Affected Versions
Red Hat OpenShift AI 2.25:- Version 1786110051 and below * is unaffected.
- Version 1786110033 and below * is unaffected.