Description
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| feast-dev | feast | ≤ 0.66.0 | — |
References
- GitHub Issue #6785 issue-tracking
- https://github.com/feast-dev/feast product
- is_auth_necessary skips all permission checks for the intra-communication identity technical-description
- the identity is taken from an explicitly unverified JWT decode technical-description
- the Helm chart hardcodes the trusted value technical-description
- VulnCheck Advisory: Feast through 0.66.0 Authentication Bypass via Unverified Token third-party-advisory