Skip to content
OpenAdvisories

Vendor

feast-dev

5 known vulnerabilities.

Products

feast 3 feast-dev/feast 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.9
    CVE-2026-55563

    Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`

    Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_tests.yml uses pull_request_target with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits,…

    feast-dev feast
  • High 7.8
    CVE-2025-11157

    Arbitrary Code Execution in feast-dev/feast

    A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py`. The vulnerability arises from the use o…

    feast-dev feast-dev/feast feast PyPI
  • High 7.4
    CVE-2024-11602

    CORS Vulnerability in feast-dev/feast

    A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API.…

    feast-dev feast-dev/feast feast PyPI