Feast’s pre‑0.65.0 release contained a workflow that used the pull_request_target GitHub Actions runner to execute integration tests against the merge commit of pull requests. Because the workflow persisted approval labels such as ok‑to‑test through newly pushed commits, a forked contributor could first have a benign revision approved, then push a malicious revision that would run with the same privileged runner. The workflow exposed cloud secrets for GCP, AWS, and Snowflake, enabling the untrusted code to obtain and misuse those credentials. This allows an attacker to execute arbitrary code on the GitHub Actions runner and to gain access to downstream cloud resources.

The vulnerability affects the open‑source Feast feature store, specifically all releases prior to v0.65.0 of the Feast repository. Users running versions such as 0.64.x or earlier are affected; the fix was implemented in the 0.65.0 release.

The vulnerability carries a CVSS score of 8.9, indicating high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, but the attack scenario relies on a normal GitHub pull‑request workflow that an external contributor can trigger. Because the untrusted code runs with the permissions of the workflow and with production credentials, the risk of credential disclosure and downstream Cloud access is significant. The likely attack vector involves a forked contributor first obtaining an ok‑to‑test or approved label, then pushing a malicious change that executes under the privileged pull_request_target runner and exploits the exposed secrets.