9.3
Critical
CVE-2026-92787 Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to…
Description
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| feast 0.66 | earliest → 0.66.0 | No fix stated |
References
- GitHub Issue #6785 github.com
- github.com github.com
- is_auth_necessary skips all permission checks for the intra-communication identity github.com
- the identity is taken from an explicitly unverified JWT decode github.com
- the Helm chart hardcodes the trusted value github.com
- VulnCheck Advisory: Feast through 0.66.0 Authentication Bypass via Unverified Token www.vulncheck.com
Timeline
- Published
- Last modified