What happened
Published 2026-09-21. The stale-label + pull_request_target pattern lets an untrusted fork contributor run attacker code in a privileged CI context holding ML-infrastructure cloud credentials. CISA SSVC assessed exploitation as 'poc' with total technical impact.
Why it matters
ML-infrastructure CI is where model training/Serving credentials live; a fork contributor gaining them via the merge pull_request_target gives supply-chain style access to model training data, feature stores and downstream cloud resources of the Feast project's deployment.
Attack vector
.github/workflows/pr_integration_tests.yml uses pull_request_target with the synchronize event and preserves ok-to-test/approved/lgtm labels across newly pushed commits. A fork contributor obtains approval on a benign revision, then pushes changed code that is executed through privileged make targets from the merge ref, exposing cloud credentials and enabling runner code execution and downstream cloud access.
Affected systems
feast-dev/feast < 0.65.0
Mitigation
Upgrade to Feast v0.65.0 (commit 76192229; GHSA-2j2x-r73g-hrr5); projects using similar workflows should remove stale approval labels on commit push.