CVE-2026-23536 — Feast: unauthenticated arbitrary file read
A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated remote attacker to read any file accessible to the server …
Published: 2026-03-20 · CVSS: 7.5 · CVSS 3.1
A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to potentially retrieve sensitive system files, application configurations, and credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7