Vulnerabilities CVE-2026-18942

CVE-2026-18942

Medium

Open

TLP:CLEAR

Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of privileges, granting the tenant administrative control over the Kubernetes cluster.

Details

CVSS Score: 5.5
EPSS Score ⓘ: 0.24%

15th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L
Confidence: 90%
Published: Aug 10, 2026
Last Modified: Aug 11, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.