rhoai/odh-feature-server-rhel9 vulnerabilities
CVEs whose affected-version data names the rhoai/odh-feature-server-rhel9 package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-92091Medium· 5.9PoCA flaw was found in jwcrypto
A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacke…
CVE-2026-80179Medium· 5.9PoCJwcrypto: jwcrypto: denial of service via malformed jwe tokens
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memor…
CVE-2026-18941High· 7.7Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication
A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to …
CVE-2026-18947High· 8.5Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization
A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intende…
CVE-2026-18948Critical· 9.9A flaw was found in Feast
A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthe…