WebSocket Endpoint Vulnerability in Feast Feature Server by Red Hat
CVE-2026-23538

7.5HIGH

Key Information:

Vendor

Feast

Status
Feast Feature Server
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
16 July 2026

What is CVE-2026-23538?

A vulnerability in the Feast Feature Server's '/ws/chat' endpoint allows attackers to establish persistent WebSocket connections without authentication. This oversight enables malicious actors to create multiple connections, potentially exhausting server resources such as memory and CPU. The result is a denial of service, which can disrupt access for legitimate users, making this an important security concern for administrators and developers using the Feast Feature Server.

Affected Version(s)

Feast Feature Server 0 < 0.59.0

References

https://access.redhat.com/security/cve/CVE-2026-23538
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2429311
issue-trackingx_refsource_REDHAT
https://github.com/red-hat-data-services/feast/pull/192

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Jitendra Yejare (Red Hat).
.