CVE-2024-11602
CORS Vulnerability in feast-dev/feast
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
CORS Vulnerability in feast-dev/feast
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.
- Record
CVE-2024-11602- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
EUVDEUVD-2025-7022
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.
- Record
EUVD-2025-7022- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wxpc-2674-rxvw
Feast Cross-Origin Resource Sharing vulnerability
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.
- Record
GHSA-wxpc-2674-rxvw- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
NVD
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.
- Record
CVE-2024-11602- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
OSVGHSA-wxpc-2674-rxvw
Feast Cross-Origin Resource Sharing vulnerability
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.
- Record
GHSA-wxpc-2674-rxvw- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
OSVPYSEC-2026-1367
Feast Cross-Origin Resource Sharing vulnerability
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.
- Record
PYSEC-2026-1367- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
feastPyPI |
through 0.40.0 | None known |
feastPyPI |
through 0.40.0, plus listed versions 0.1.00.1.0.post00.1.20.1.2.post00.1.2.post1 Show 45 moreShow less0.10.00.10.10.10.1rc10.10.1rc30.10.20.10.30.10.40.10.50.10.60.10.70.10.80.11.00.12.00.12.10.13.00.14.00.14.10.15.00.15.10.16.00.16.10.17.00.18.00.18.10.19.00.19.10.19.20.19.30.19.40.20.00.20.10.20.20.21.00.21.10.21.20.21.30.22.00.22.10.22.20.22.30.22.40.23.00.23.10.23.20.24.0 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-11602 is a high vulnerability (CVSS 7.4) in Feast-dev Feast-dev/feast, published March 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. No source names a fixed version.
References
Left out here: 71 versions. The JSON record has them.