Description

Finding
On-demand, stream, and batch feature views serialize their Python UDF with dill.dumps() into the protobuf registry. Every consumer deserializes with dill.loads() without validation. dill is a pickle superset — dill.loads() on attacker-controlled bytes is arbitrary code execution (__reduce__).

Files:

sdk/python/feast/transformation/pandas_transformation.py:150 — udf=dill.loads(user_defined_function_proto.body)

sdk/python/feast/transformation/python_transformation.py:168 — same

sdk/python/feast/transformation/substrait_transformation.py:163

sdk/python/feast/transformation/ray_transformation.py:288

sdk/python/feast/stream_feature_view.py:335

sdk/python/feast/dqm/profilers/ge_profiler.py:158

Repository: red-hat-data-services/feast
ASVS: V5.5.3 (deserialization of untrusted data), V1.5.2
CWE: CWE-502
Severity: Critical

Attack Paths
Path 1 — Feature server RCE (cross-tenant):

Tenant A stores a malicious UDF via ApplyOnDemandFeatureView (gRPC or REST)

The shared feature-server pod refreshes the registry and loads the ODFV

Payload executes as the feature-server service account when any user calls /get-online-features referencing that view, or immediately on from_proto

Because the feature-server serves all projects in a FeatureStore CR, this crosses tenant boundaries

When combined with F-04 (default no_auth), step 1 requires no authentication at all.

Path 2 — Pre-authorization RCE on registry server:
registry_server.py:341-354: from_proto() triggers dill.loads() before assert_permissions_to_update runs. Even with auth.type: kubernetes/oidc enabled, any authenticated principal regardless of Feast permissions achieves RCE on the registry-server pod.

Impact
Unauthenticated RCE on the feature-server pod in default configurations. With auth enabled, any authenticated principal achieves RCE on the registry-server pod (authz bypassed). Cross-tenant data access and lateral movement via the feature-server's SA and network position.

Remediation
Document that registry write access is equivalent to code execution on the feature server

Force auth.type: kubernetes in operator-generated config and deny-by-default registry writes

Long-term: replace dill with the source-string + restricted-exec path (udf_string) or Substrait-only transformation mode

Immediate: move assert_permissions_to_update before from_proto() in registry server to close the pre-authz bypass