CVE-2024-11602 CORS Vulnerability in feast-dev/feast
Improper CORS configuration allows any external domain to access the API, potentially exposing sensitive information and bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-11602?
CVE-2024-11602 is a high-severity vulnerability in feast-dev/feast, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.
Weakness: CWE-346
Which versions are affected by CVE-2024-11602?
3 open source packages ship an affected version, including feast.
| Package | Affected | Fixed in |
|---|---|---|
feast PyPI | All versions to 0.40.0 | None |
feast PyPI | All versions to 0.40.0 | None |
feast PyPI | All versions to 0.40.0 | None |
How do I fix CVE-2024-11602?
No fix has been published for CVE-2024-11602 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-11602 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11602 exists.
Sources
Also known as GHSA-wxpc-2674-rxvw, PYSEC-2026-1367.