CVE-2026-23537: Feast: unauthenticated arbitrary file write

Synopsis

An unauthenticated arbitrary file write vulnerability exists in the Feast Feature Server's /save-document endpoint. The flaw is reachable over the network with no credentials required, as path-restriction protections in the endpoint can be bypassed by a remote attacker. Successful exploitation allows an attacker to overwrite application configuration files or startup scripts, exhaust disk space, or achieve remote code execution. A patched-image rebuild at version 0.59.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Feast Feature Server over the network; the vulnerable endpoint is exposed as an HTTP service.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to reach or exploit the /save-document endpoint.

• Victim interactionNot required

  The attacker operates entirely without any action from a legitimate user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or environmental factors need to be satisfied.

Blast Radius

• Overwrites application configuration files or startup scripts, enabling persistent unauthorized system modifications.
• Writes arbitrary files to disk until storage is exhausted, crashing dependent services through denial of disk space.
• Replaces startup scripts or configuration with attacker-controlled content, creating a path to remote code execution on the host.
• Disrupts the integrity of the Feature Server and any ML pipelines or model-serving workflows that depend on its configuration state.