CVE-2026-23537
criticalpriority · track · 0OT risk · elevatedEPSS 0.010 · 64 %ileEUUSEPSS · scored 2026-10-27
A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling an attacker to overwrite vital application configurations or startup scripts. Because this flaw requires no credentials or special privileges, any attacker with network access to the server can potentially compromise the integrity of the system. This could lead to unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (1)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2026-23537cnnvd
- https://access.redhat.com/security/cve/CVE-2026-23537enisa_euvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2429304enisa_euvd
- https://github.com/red-hat-data-services/feast/pull/192enisa_euvd
- https://access.redhat.com/security/cve/CVE-2026-23537nvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2429304nvd
- https://github.com/red-hat-data-services/feast/pull/192nvd
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23537.jsonnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan