PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-11157 feast-dev CVE debrief

CVE-2025-11157 is a high-severity remote code execution vulnerability in feast-dev/feast version 0.53.0. The vulnerability exists in the Kubernetes materializer job located at `feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py`. An attacker can exploit this vulnerability by modifying YAML files to execute OS commands on the worker pod, potentially leading to cluster takeover, data poisoning, and supply-chain sabotage. The vulnerability has a CVSS score of 7.8 and is classified as HIGH. The CVE was published on January 1, 2026, and last modified on June 30, 2026.

Vendor
feast-dev
Product
feast-dev/feast
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-01
Original CVE updated
2026-07-15
Advisory published
2026-01-01
Advisory updated
2026-07-15

Who should care

Organizations using feast-dev/feast version 0.53.0 should be aware of this vulnerability and take immediate action to mitigate it. This vulnerability can be exploited remotely, and an attacker can execute OS commands on the worker pod, potentially leading to cluster takeover, data poisoning, and supply-chain sabotage. Security teams and administrators responsible for Kubernetes deployments should prioritize patching this vulnerability.

Technical summary

The vulnerability arises from the use of `yaml.load(..., Loader=yaml.Loader)` to deserialize `/var/feast/feature_store.yaml` and `/var/feast/materialization_config.yaml`. This method allows for the instantiation of arbitrary Python objects, enabling an attacker with the ability to modify these YAML files to execute OS commands on the worker pod. The vulnerability can be exploited before the configuration is validated, potentially leading to cluster takeover, data poisoning, and supply-chain sabotage. The CVSS vector for this vulnerability is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

This vulnerability has a high CVSS score of 7.8 and is classified as HIGH. Organizations should prioritize patching this vulnerability to prevent potential exploitation.

Recommended defensive actions

  • Apply the patch from the feast-dev/feast repository to update the Kubernetes materializer job.
  • Restrict access to YAML files to prevent unauthorized modifications.
  • Implement additional security measures, such as validating YAML files before deserialization.
  • Monitor Kubernetes deployments for suspicious activity.
  • Consider implementing compensating controls, such as network segmentation or intrusion detection systems.

Evidence notes

The CVE-2025-11157 vulnerability was reported by [email protected] and has been documented in various sources, including the NVD and Red Hat security advisories. The vulnerability affects feast-dev/feast version 0.53.0 and has a CVSS score of 7.8.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-11157 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-11157

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-11157 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-11157

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/feast-dev/feast/commit/b2e37ff37953b68ae833f6874ab5bc510a4ca5fb

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://huntr.com/bounties/46d4d585-b968-4a76-80ce-872bc5525564

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:10184

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/security/cve/CVE-2025-11157

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-11157.json

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.