VulnerabilityAwaiting Analysis
CVE-2026-18942
A malicious tenant could inject arbitrary code into their feature repository.
MEDIUM 5.5EPSS 0.31%
Does this matter?
Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of privileges, granting the tenant administrative control over the Kubernetes cluster.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L
- EPSS
- 0.31% probability · 23th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Source
- secalert@redhat.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.