Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92787Feast through 0.66.0 Authentication Bypass via Unverified Token

Critical 9.8

In plain English

A critical-severity hard-coded credentials in feast from feast-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.7%top 46.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.

Affected products (as reported)

Vendor	Product	Versions
feast-dev	feast	0 – through 0.66.0

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Issue #6785 issue-tracking
https://github.com/feast-dev/feast product
is_auth_necessary skips all permission checks for the intra-communication identity technical-description
the identity is taken from an explicitly unverified JWT decode technical-description
the Helm chart hardcodes the trusted value technical-description
VulnCheck Advisory: Feast through 0.66.0 Authentication Bypass via Unverified Token third-party-advisory