CVE-2026-92787 feast-dev CVE debrief

Who should care

Defenders responsible for Feast deployments, security teams, and developers should assess exposure and prioritize verification of Feast deployments for version 0.66.0 or earlier. They should also review the configuration of JWT token signature verification and implement role-based access control checks to prevent potential authentication bypass attacks.

Why it matters

CVE-2026-92787 allows attackers to bypass authentication and gain unchecked access to Feast deployments, requiring defenders to verify deployments and assess exposure.

• Potential authentication bypass attacks
• Unchecked read and write access to all entities, feature views, data sources, and permission policies
• Bypass of role-based access control

Technical summary

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server. This vulnerability can lead to significant data breaches and system compromise if not properly addressed. Defenders should prioritize verifying Feast deployments for version 0.66.0 or earlier and assess exposure to potential authentication bypass attacks.

Defensive priority

Defenders should prioritize verifying Feast deployments for version 0.66.0 or earlier and assess exposure to potential authentication bypass attacks.

Recommended defensive actions

• Verify Feast deployments for version 0.66.0 or earlier
• Assess exposure to potential authentication bypass attacks
• Implement role-based access control checks
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the corpus lacks specific information on affected or fixed versions beyond 0.66.0. To verify Feast deployments, defenders should check for version 0.66.0 or earlier and assess the configuration of JWT token signature verification. Additional information from other sources may be necessary to fully understand the vulnerability's impact and to implement effective mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.