High [CVE-2026-56121] Remote Code Execution via Unsafe Deserialization in gRPC Registry Server

Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server.

The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account. A flaw was found in Feast.

This enables them to execute operating system commands as the Feast service account, leading to a complete compromise of the affected system. Red Hat OpenShift AI ships Feast versions affected by CVE-2026-56121.

This flaw allows remote code execution only against the Feast registry gRPC server (feast serve_registry, port 6570) when that service is running and reachable. Default OpenShift AI installations are not affected.

Installing OpenShift AI deploys the Feast operator but does not create a FeatureStore instance or start a registry server. The default FeatureStore configuration runs the online feature server only (feast serve), which does not expose the vulnerable gRPC endpoint.

Workbench and pipeline runtime images include Feast as a client library and do not start a registry server.