CVE-2026-92787
Feast through 0.66.0 Authentication Bypass via Unverified Token
CVSS 4.0 9.3 CRITICALCVSS 3.1 9.8 CRITICALCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-92787
PublishedFeast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-92787 · CVE overview and exploitation status
cve-program · CVE-2026-92787
- https://github.com/feast-dev/feast/issues/6785
- https://github.com/feast-dev/feast
- https://github.com/feast-dev/feast/blob/v0.66.0/sdk/python/feast/permissions/security_manager.py#L248-L264
- https://github.com/feast-dev/feast/blob/f296d4b/sdk/python/feast/permissions/auth/oidc_token_parser.py#L152-L156
- https://github.com/feast-dev/feast/blob/f296d4b/infra/charts/feast-feature-server/templates/deployment.yaml#L46-L47
- https://www.vulncheck.com/advisories/feast-through-0.66.0-authentication-bypass-via-unverified-token
Related changes
Linked by CVE identifierNo related changes are available here.