A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.
To mitigate this vulnerability, restrict network access to the Feast feature server to trusted clients only, using firewall rules or network policies. If the Feast feature server is configured with the default no_auth setting, enable Kubernetes/OIDC authentication to require user authentication for access. While enabling authentication will prevent unauthenticated exploitation, any authenticated user will still be able to trigger the denial of service due to the authorization bypass.