A critical authorization vulnerability in the Feast feature store allows authenticated contributors to achieve remote code execution and credential theft through insecure GitHub Action workflows.

The vulnerability resides in the pr_integration_tests.yml workflow, which incorrectly preserves approval labels across commit synchronizations. This allows a user with low privileges to gain elevated execution rights by modifying code after an initial benign approval.

The exploitation of this flaw can lead to a complete compromise of the CI environment, resulting in the theft of sensitive GCP, AWS, and Snowflake credentials. Given the CVSS score of 8.9, this represents a high risk of unauthorized access to downstream cloud infrastructure, potentially leading to data breaches and significant operational disruption.

Immediate Action: Update the Feast feature store to version 0.65.0 or later to apply the corrected workflow configurations.

Proactive Monitoring: Audit CI/CD logs for unexpected execution of make targets or unauthorized access attempts against cloud service providers using credentials associated with the build environment.

Compensating Controls: Implement strict branch protection rules and require manual approval for workflows triggered by external pull requests to prevent the automatic execution of untrusted code.

Public Exploit Available: No (Exploit_available: false)

Organizations utilizing Feast must prioritize the upgrade to version 0.65.0 immediately to eliminate the insecure workflow logic. Because this vulnerability facilitates the compromise of cloud-native credentials, failure to patch leaves the entire connected infrastructure ecosystem exposed to potential lateral movement and long-term persistence by malicious actors.