CVE-2026-56121: Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization

Synopsis

An unsafe deserialization vulnerability in Feast (the open-source feature store), present in versions before 0.63.0, allows an unauthenticated remote attacker to execute arbitrary operating system commands on the registry server. The flaw is reached over the network with no credentials required: the registry server decodes and deserializes a user-supplied field via dill.loads() before performing any authorization check, meaning a crafted gRPC request is all that is needed. Successful exploitation gives the attacker full remote code execution as the Feast service account, with high-confidence impact on confidentiality, integrity, and availability of the host. A patched-image rebuild at version 0.63.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Feast registry server must be reachable over the network; an attacker sends a crafted gRPC request directly to it from any network-accessible position.

• AuthenticationNot required

  No credentials or account of any kind are needed; the vulnerable dill.loads() call executes before any authorization check is performed.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any user or operator of the affected system.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and condition-free, requiring only a single crafted gRPC request with a malicious serialized Python object in the user_defined_function.body field.

Blast Radius

• Attacker executes arbitrary OS commands as the Feast service account, gaining full control of the registry server process.
• All feature store data readable by the service account, including stored feature definitions and any secrets accessible from the process environment, is exposed.
• The attacker can modify or delete persisted feature view registrations, corrupting the feature store state for downstream ML pipelines.
• The registry server process can be crashed or held under the attacker's control, disrupting feature serving for all dependent workloads.