CVE-2026-18948— Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server
Quick assessment
Affected
Red Hat Red Hat OpenShift AI 2.25
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Red Hat OpenShift AI是美国Red Hat公司的一款混合云人工智能平台，为数据科学家和开发者提供跨混合云环境构建、开发、训练、部署、服务和监控机器学习（ML）模型及 AI 应用的全生命周期工具。 Red Hat OpenShift AI存在安全漏洞，该漏洞源于系统对使用dill库序列化并存储在注册表中的用户定义函数（UDF）反序列化不当，可能导致远程攻击者存储恶意UDF，在默认配置下执行未经验证的任意代码，或使已认证攻击者通过绕过反序列化授权检查，在注册表服务器上执行任意代码，进而造成跨
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 17
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat OpenShift AI (RHOAI) | any |
unaffected |
any |
unaffected | ||
any |
unaffected | ||
any |
unaffected | ||
any |
unaffected | ||
any |
unaffected | ||
any |
unaffected | ||
any |
unaffected | ||
| … +5 more rows | |||
| Red Hat | Red Hat OpenShift AI 2.25 | 1786110051< * |
unaffected |
| Red Hat | Red Hat OpenShift AI 3.3 | 1786110033< * |
unaffected |
| Red Hat | Red Hat OpenShift AI 3.4 | 1786107278< * |
unaffected |
1787068065< * |
unaffected | ||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-18948
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat OpenShift AI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat OpenShift AI是美国Red Hat公司的一款混合云人工智能平台，为数据科学家和开发者提供跨混合云环境构建、开发、训练、部署、服务和监控机器学习（ML）模型及 AI 应用的全生命周期工具。 Red Hat OpenShift AI存在安全漏洞，该漏洞源于系统对使用dill库序列化并存储在注册表中的用户定义函数（UDF）反序列化不当，可能导致远程攻击者存储恶意UDF，在默认配置下执行未经验证的任意代码，或使已认证攻击者通过绕过反序列化授权检查，在注册表服务器上执行任意代码，进而造成跨
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat OpenShift AI 2.25 | 1786110051 ~ * |
cpe:/a:redhat:openshift_ai:2.25::el9
|
|
| Red Hat | Red Hat OpenShift AI 3.3 | 1786110033 ~ * |
cpe:/a:redhat:openshift_ai:3.3::el9
|
|
| Red Hat | Red Hat OpenShift AI 3.4 | 1786107278 ~ * |
cpe:/a:redhat:openshift_ai:3.4::el9
|
|
| Red Hat | Red Hat OpenShift AI 3.4 | 1787068065 ~ * |
cpe:/a:redhat:openshift_ai:3.4::el9
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
II. Public POCs for CVE-2026-18948
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18948
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-18948 (6)
-
-
-
-
-
🔗 RHSA-2026:53261 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
Same Patch Batch · Red Hat · 2026-08-10 · 28 CVEs total
| CVE-2026-14450 | 9.9 CRITICAL | Maas-billing: maas api: privilege escalation via forged http headers due to missing authen |
| CVE-2026-18950 | 8.8 HIGH | Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref i |
| CVE-2026-18949 | 8.8 HIGH | Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac man |
| CVE-2026-18951 | 8.8 HIGH | Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainj |
| CVE-2026-18617 | 8.8 HIGH | Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams |
| CVE-2026-18982 | 8.8 HIGH | Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/ad |
| CVE-2026-18608 | 8.7 HIGH | Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.o |
| CVE-2026-18947 | 8.5 HIGH | Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized |
| CVE-2026-71576 | 8.5 HIGH | Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source( |
| CVE-2026-15467 | 8.1 HIGH | Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass |
| CVE-2026-15581 | 8.0 HIGH | Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-r |
| CVE-2026-63622 | 7.8 HIGH | Libvirt: swtpm privilege escalation via symlink following |
| CVE-2026-18941 | 7.7 HIGH | Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant |
| CVE-2026-18621 | 7.6 HIGH | Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypass |
| CVE-2026-19387 | 7.6 HIGH | Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec im |
| CVE-2026-18611 | 7.5 HIGH | Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand |
| CVE-2026-18618 | 7.5 HIGH | Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable |
| CVE-2026-19389 | 7.1 HIGH | Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux |
| CVE-2026-18620 | 7.1 HIGH | Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authoriza |
| CVE-2026-19278 | 6.8 MEDIUM | Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m ro |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Red Hat OpenShift AI 2.25
-
CVE-2026-18620
Data-sciences-pipeline: user-controlled serviceaccount for w -
CVE-2026-18618
Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 -
CVE-2026-18611
Data-science-pipelines-operator: dspo: cryptographically wea -
CVE-2026-18982
Odh-training-operator-rhel9: rhoai fork aggregates training -
CVE-2026-18950
Odh-dashboard: odh-dashboard: confused-deputy privilege esca
Same vendor: Red Hat
-
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc
Same weakness: CWE-502
-
CVE-2026-103877
Apache Directory LDAP API: Unsafe loading of Java code from -
CVE-2026-55083
DHIS2: Unsafe Java Deserialization - Remote Code Execution ( -
CVE-2026-12544
Foreman: ssti and insecure deserialization in foreman-rake c -
CVE-2026-97284
WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vu -
CVE-2026-94390
WordPress Hide Shipping Method For WooCommerce plugin <= 1.5
V. Comments for CVE-2026-18948
No comments yet