Vulnerability Description
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/feast-dev/feast
- https://github.com/feast-dev/feast/blob/f296d4b/infra/charts/feast-feature-serve
- https://github.com/feast-dev/feast/blob/f296d4b/sdk/python/feast/permissions/aut
- https://github.com/feast-dev/feast/blob/v0.66.0/sdk/python/feast/permissions/sec
- https://github.com/feast-dev/feast/issues/6785
- https://www.vulncheck.com/advisories/feast-through-0.66.0-authentication-bypass-
- https://github.com/feast-dev/feast/issues/6785
FAQ
What is CVE-2026-92787?
CVE-2026-92787 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcod...
How severe is CVE-2026-92787?
CVE-2026-92787 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-92787?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.