CyberRota Analysis
AI-GeneratedFeast versions prior to 0.66.0 are vulnerable due to inadequate verification of JWT token signatures, enabling attackers to bypass role-based access control by using unverified tokens with hardcoded claims. This flaw allows unauthorized access to sensitive internal identities, granting attackers unrestricted read and write access to all entities, feature views, data sources, and permission policies on the server. Organizations utilizing Feast should prioritize immediate updates to mitigate this critical security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.