ZeroDay Findings
Sign inSign up

Findings

CVE-2026-23536

A security issue was discovered in the Feast Feature Server's endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process.

Published Mar 20, 2026 · updated Jul 15, 2026

A security issue was discovered in the Feast Feature Server's endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to potentially retrieve sensitive system files, application configurations, and credentials.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 20, 2026 · NIST NVD

    Detected

    A security issue was discovered in the Feast Feature Server's endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to potentially retrieve sensitive system files, application configurations, and credentials.

  2. Jul 15, 2026 · NIST NVD

    Updated

    A security issue was discovered in the Feast Feature Server's endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to potentially retrieve sensitive system files, application configurations, and credentials.

Sources

  • CVE.orgVulnerability recordCVE-2026-23536

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-23536

    A security issue was discovered in the Feast Feature Server's endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restr

    nvd.nist.gov

References