Feast feature store RCE scores 9.9, plus deserialization bugs fan across JBoss clusters

Infinispan session replication deserializes session data through JBoss Marshalling with zero class filtering. An attacker who can inject a crafted session object gets remote code execution on every node in the cluster via well-known deserialization gadget chains. One poisoned session fans out to all cluster members automatically.

Affected estate

Teams running JBoss EAP or WildFly clusters with Infinispan-based session replication enabled

How to check

Check your standalone-ha.xml or domain.xml for the `<distributed-cache name="http-sessions">` stanza. Confirm the JBoss Marshalling version with `module info org.jboss.marshalling` in the EAP CLI.

Included because

remote code execution; cluster-wide blast radius; no class filtering; CVSS 8.8

Action

Upgrade JBoss Marshalling and Infinispan modules to patched versions. If you can't patch right away, disable session replication or switch to a non-replicated session store.

Why it matters

A single malicious session object gives an attacker code execution on every cluster node simultaneously.

The Open Data Hub dashboard doesn't validate the roleRef field when creating RoleBindings, so an authenticated user can point a binding at any role they want, including cluster-admin. That's a straight privilege escalation: a regular dashboard user can grant themselves full admin rights in their namespace and potentially pivot to persistent cluster-wide control.

Affected estate

OpenShift or Kubernetes operators running Open Data Hub (odh-dashboard) in multi-user or shared-cluster environments

How to check

Run `oc get pods -n odh-dashboard -o jsonpath='{.items[*].spec.containers[*].image}'` to confirm the running image version. Also run `oc get rolebindings -A -o json | jq '.items[] | select(.roleRef.name=="cluster-admin")'` to spot suspicious bindings.

Included because

authenticated; privilege escalation to cluster-admin; multi-tenant risk; CVSS 8.8

Action

Upgrade odh-dashboard to the patched release and remove any unauthorized RoleBindings discovered during the audit.

Why it matters

Any authenticated dashboard user can escalate to cluster-admin, breaking all tenant isolation.

The Feast /materialize and /materialize-incremental endpoints skip permission checks when the feature_views field is missing from the request. An attacker can send a request without that field to trigger full re-materialization of every feature view across all tenants. The result is a denial-of-service through heavy resource consumption and potential data corruption in materialized stores.

Affected estate

ML platform teams running Feast with materialization endpoints exposed, especially multi-tenant deployments

How to check

Run `pip show feast` for version info. Check whether these endpoints are reachable from untrusted networks by curling them directly.

Included because

unauthenticated; authorization bypass; denial of service; data corruption; CVSS 8.5

Action

Upgrade Feast to the fixed release. As a workaround, add authentication or network-level restrictions on the materialization endpoints.

Why it matters

Unauthenticated attackers can corrupt materialized data and burn compute resources across every tenant.

When JBoss EAP runs with the security manager (-secmgr), the OpenJDK ORB's JDKBridge trusts attacker-supplied codebase URLs during CORBA/IIOP deserialization on port 3528. An unauthenticated attacker can point the server at a remote URL hosting a malicious class, and the JVM loads and instantiates it before EJB security interceptors kick in. This only applies when -secmgr is enabled and port 3528 is reachable.

Affected estate

Teams running JBoss EAP with the -secmgr flag and IIOP/CORBA enabled on port 3528

How to check

Check your EAP startup script for -secmgr. Confirm port 3528 is listening with `ss -tlnp | grep 3528` or equivalent. Review standalone.xml for the iiop-openjdk subsystem.

Included because

unauthenticated; remote code execution; pre-auth; CVSS 8.1; requires -secmgr and exposed IIOP port

Action

Patch openjdk-orb or upgrade JBoss EAP. As a quick mitigation, firewall port 3528 from untrusted sources or remove the iiop-openjdk subsystem if unused.

Why it matters

Unauthenticated remote class loading before security interceptors run means pre-auth RCE if the port is exposed.