Veille CVE

Mercredi 24 juin 2026

1 CVE sur 7

Critique 1 Élevée 6 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Python python » ✕
  1. CVE-2026-56121 9.8 Critique

    feast-dev feast · Red Hat OpenShift AI 3.4 · Red Hat OpenShift AI (RHOAI)

    Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account.