@@ -57,6 +57,15 @@ jobs:
       - name: Install dependencies
         run: make install-python-dependencies-ci
       - name: Test Python
+        env:
+          # The exact dependency set is installed by `uv pip sync` from the
+          # pinned pyXX-ci-requirements.txt above (compatible protobuf +
+          # grpcio-health-checking). uv.lock is not committed, so letting
+          # `uv run` auto-sync here would re-resolve the uncapped pyproject
+          # deps and downgrade protobuf below grpcio's generated-code version,
+          # breaking the protobuf gencode/runtime check at import time. Use the
+          # already-installed environment instead of re-resolving.
+          UV_NO_SYNC: "1"
         run: |
           # Set up environment for Ray workers to access packages
           export PATH="${{ github.workspace }}/.venv/bin:$PATH"
 
@@ -21,6 +21,16 @@ TOOL_DIR := $(ROOT_DIR)/tools
 export GOBIN=$(TOOL_DIR)/bin
 export PATH := $(TOOL_DIR)/bin:$(PATH)
 
+# CI installs the exact, mutually compatible dependency set via
+# `uv pip sync` from the pinned sdk/python/requirements/pyXX-ci-requirements.txt
+# (install-python-dependencies-ci). uv.lock is not committed, so a plain
+# `uv run` would auto-sync and re-resolve the uncapped pyproject dependencies,
+# which can install an inconsistent set -- e.g. protobuf older than the gencode
+# baked into grpcio's health_pb2, which then fails the protobuf gencode/runtime
+# check at import time. Run every `uv run` target against the already-installed
+# environment instead of re-resolving. (pixi-based targets are unaffected.)
+export UV_NO_SYNC := 1
+
 MVN := mvn -f java/pom.xml ${MAVEN_EXTRA_OPTS}
 OS := linux
 ifeq ($(shell uname -s), Darwin)
 
@@ -30,11 +30,45 @@ Options:
 -h, --host TEXT                 Specify a host for the server [default: 0.0.0.0]
 -p, --port INTEGER              Specify a port for the server [default: 8888]
 -r, --registry_ttl_sec INTEGER  Number of seconds after which the registry is refreshed. Default is 5 seconds.
+--cors-allowed-origins TEXT     Comma-separated list of trusted origins allowed to make cross-origin (CORS) requests.
 --help                          Show this message and exit.
 ```
 
 This will spin up a Web UI on localhost which automatically refreshes its view of the registry every `registry_ttl_sec`
 
+#### Cross-Origin Resource Sharing (CORS)
+
+By default the UI server does **not** allow cross-origin requests: the bundled
+Web UI is served from the same origin as the API, so it keeps working without
+any CORS policy. This avoids [CVE-2024-11602](https://nvd.nist.gov/vuln/detail/CVE-2024-11602),
+where the server previously reflected every origin (`Access-Control-Allow-Origin: *`)
+together with credentials, letting any site a user visited issue authenticated
+requests to the server.
+
+If you host the UI (or another browser client) on a different origin, opt in by
+passing an explicit allowlist of trusted origins, either with the
+`--cors-allowed-origins` flag or the `FEAST_UI_CORS_ALLOWED_ORIGINS`
+environment variable:
+
+```bash
+feast ui --cors-allowed-origins "https://feast.example.com,https://app.example.com"
+
+# or, equivalently:
+export FEAST_UI_CORS_ALLOWED_ORIGINS="https://feast.example.com,https://app.example.com"
+feast ui
+```
+
+Each value must be a bare origin — scheme and host with an optional port, and
+**no path, query, or trailing slash** (e.g. `https://app.example.com` or
+`http://localhost:3000`, not `https://app.example.com/ui`). Browsers send the
+`Origin` header without a path, so a value that includes one never matches and
+the request is silently rejected.
+
+For production, list the exact origins you trust. Passing `*` is accepted but
+**allows credentialed cross-origin requests from any site** (the CVE-2024-11602
+pattern) and is intended for local development only; the server logs a warning
+when it is used.
+
 #### Curl Generator Feature Server URL
 
 The Curl Generator uses a default Feature Server URL when building the example curl command. You can configure
 
@@ -44,6 +44,22 @@
     show_default=False,
     help="path to TLS(SSL) certificate public key. You need to pass --key arg as well to start server in TLS mode",
 )
+@click.option(
+    "--cors-allowed-origins",
+    "cors_allowed_origins",
+    type=click.STRING,
+    default="",
+    envvar="FEAST_UI_CORS_ALLOWED_ORIGINS",
+    show_default=False,
+    help=(
+        "Comma-separated list of trusted origins allowed to make cross-origin "
+        "(CORS) requests to the UI server, e.g. "
+        "'https://feast.example.com,https://app.example.com'. May also be set "
+        "via the FEAST_UI_CORS_ALLOWED_ORIGINS environment variable. By default "
+        "no cross-origin requests are allowed. Avoid '*', which combined with "
+        "credentials exposes the server to CVE-2024-11602."
+    ),
+)
 @click.pass_context
 def ui(
     ctx: click.Context,
@@ -52,6 +68,7 @@ def ui(
     root_path: str = "",
     tls_key_path: str = "",
     tls_cert_path: str = "",
+    cors_allowed_origins: str = "",
 ):
     """
     Shows the Feast UI over the current directory
@@ -60,11 +77,15 @@ def ui(
         raise click.BadParameter(
             "Please configure --key and --cert args to start the feature server in SSL mode."
         )
+    cors_allowed_origins_list = [
+        origin.strip() for origin in cors_allowed_origins.split(",") if origin.strip()
+    ]
     store = create_feature_store(ctx)
     store.serve_ui(
         host=host,
         port=port,
         root_path=root_path,
         tls_key_path=tls_key_path,
         tls_cert_path=tls_cert_path,
+        cors_origins=cors_allowed_origins_list,
     )
@@ -4794,6 +4794,7 @@ def serve_ui(
         root_path: str = "",
         tls_key_path: str = "",
         tls_cert_path: str = "",
+        cors_origins: Optional[List[str]] = None,
     ) -> None:
         """Start the UI server locally"""
         if flags_helper.is_test():
@@ -4810,6 +4811,7 @@ def serve_ui(
             root_path=root_path,
             tls_key_path=tls_key_path,
             tls_cert_path=tls_cert_path,
+            cors_origins=cors_origins,
         )
 
     def serve_registry(
 
@@ -874,16 +874,37 @@ def get_app(
     store: "feast.FeatureStore",
     project_id: str,
     root_path: str = "",
+    cors_origins: Optional[List[str]] = None,
 ):
     app = FastAPI()
 
-    app.add_middleware(
-        CORSMiddleware,
-        allow_origins=["*"],
-        allow_credentials=True,
-        allow_methods=["*"],
-        allow_headers=["*"],
-    )
+    # CORS is only required for cross-origin browsers calling the API. The UI is
+    # served from this same app (same origin), so it keeps working without any
+    # permissive CORS policy. Allowing every origin together with credentials
+    # (``allow_origins=["*"]`` + ``allow_credentials=True``) lets any website a
+    # user visits issue authenticated cross-origin requests to this server
+    # (CVE-2024-11602 / CWE-346), so it is disabled by default. Operators who
+    # need cross-origin access must opt in with an explicit list of trusted
+    # origins via ``feast ui --cors-allowed-origins``.
+    if cors_origins:
+        if "*" in cors_origins:
+            # Honor an explicit wildcard (an informed, opt-in operator choice,
+            # like Feast's own ``auth_type=no_auth``), but make the risk loud:
+            # with credentials, Starlette reflects the caller's origin for any
+            # site, which is the CVE-2024-11602 pattern. Not a safe default.
+            logger.warning(
+                "CORS is configured to allow all origins ('*'). This permits "
+                "credentialed cross-origin requests from any site and is "
+                "intended for development only. Configure an explicit list of "
+                "trusted origins for production deployments."
+            )
+        app.add_middleware(
+            CORSMiddleware,
+            allow_origins=cors_origins,
+            allow_credentials=True,
+            allow_methods=["*"],
+            allow_headers=["*"],
+        )
 
     _setup_rest_mode(app, store)
 
@@ -1207,11 +1228,13 @@ def start_server(
     root_path: str = "",
     tls_key_path: str = "",
     tls_cert_path: str = "",
+    cors_origins: Optional[List[str]] = None,
 ):
     app = get_app(
         store,
         project_id,
         root_path,
+        cors_origins=cors_origins,
     )
 
     logger.info(f"Starting Feast UI server on {host}:{port}")
 
@@ -0,0 +1,53 @@
+from unittest.mock import MagicMock
+
+from click.testing import CliRunner
+
+from feast.cli.ui import ui
+
+
+def _run(mocker, args, env=None):
+    mock_store = MagicMock()
+    mocker.patch("feast.cli.ui.create_feature_store", return_value=mock_store)
+    result = CliRunner().invoke(ui, args, obj={}, env=env)
+    assert result.exit_code == 0, result.output
+    return mock_store
+
+
+def test_cors_allowed_origins_defaults_to_empty(mocker):
+    """Without the flag, no origins are forwarded (CORS stays disabled)."""
+    store = _run(mocker, [])
+    store.serve_ui.assert_called_once()
+    assert store.serve_ui.call_args.kwargs["cors_origins"] == []
+
+
+def test_cors_allowed_origins_flag_is_split(mocker):
+    """The comma-separated flag is parsed into a trimmed list of origins."""
+    store = _run(
+        mocker,
+        [
+            "--cors-allowed-origins",
+            "https://feast.example.com, https://app.example.com",
+        ],
+    )
+    assert store.serve_ui.call_args.kwargs["cors_origins"] == [
+        "https://feast.example.com",
+        "https://app.example.com",
+    ]
+
+
+def test_cors_allowed_origins_from_env_var(mocker):
+    """FEAST_UI_CORS_ALLOWED_ORIGINS is honored when the flag is absent."""
+    store = _run(
+        mocker,
+        [],
+        env={"FEAST_UI_CORS_ALLOWED_ORIGINS": "https://feast.example.com"},
+    )
+    assert store.serve_ui.call_args.kwargs["cors_origins"] == [
+        "https://feast.example.com"
+    ]
+
+
+def test_help_advertises_cors_flag():
+    result = CliRunner().invoke(ui, ["--help"])
+    assert "--cors-allowed-origins" in result.output
+    assert "FEAST_UI_CORS_ALLOWED_ORIGINS" in result.output
@@ -326,6 +326,96 @@ def test_registry_refresh_endpoint_error(mock_feature_store):
         assertpy.assert_that(resp.status_code).is_equal_to(500)
 
 
+# ---------- CORS tests (CVE-2024-11602) ----------
+
+
+@contextlib.contextmanager
+def _cors_client(mock_feature_store, cors_origins):
+    """Yield a TestClient for a UI app built with the given cors_origins.
+
+    The static-files directory is only valid while the TemporaryDirectory is
+    open, so the client must be used inside this context.
+    """
+    mock_registry = MagicMock()
+    mock_registry.list_projects.return_value = []
+    mock_feature_store.registry = mock_registry
+
+    with tempfile.TemporaryDirectory() as temp_dir:
+        _create_mock_ui_files(temp_dir)
+
+        with _setup_importlib_mocks(temp_dir):
+            app = get_app(
+                mock_feature_store,
+                TEST_PROJECT_NAME,
+                cors_origins=cors_origins,
+            )
+        yield TestClient(app)
+
+
+def test_cors_disabled_by_default(mock_feature_store):
+    """Without cors_origins, no cross-origin request is granted.
+
+    Regression test for CVE-2024-11602: the server used to send
+    ``Access-Control-Allow-Origin: *`` with credentials, letting any website a
+    user visits read authenticated responses from this server. The CVE's
+    proof of concept is exactly this -- a cross-origin GET carrying an Origin
+    header.
+    """
+    with _cors_client(mock_feature_store, cors_origins=None) as client:
+        response = client.get("/health", headers={"Origin": "https://evil.example.com"})
+        assertpy.assert_that(response.status_code).is_equal_to(EXPECTED_SUCCESS_STATUS)
+        assertpy.assert_that(response.headers).does_not_contain_key(
+            "access-control-allow-origin"
+        )
+
+
+def test_cors_allows_only_configured_origins(mock_feature_store):
+    """With an explicit allowlist, only trusted origins are echoed back."""
+    trusted = "https://feast.example.com"
+    with _cors_client(mock_feature_store, cors_origins=[trusted]) as client:
+        allowed = client.get("/health", headers={"Origin": trusted})
+        assertpy.assert_that(
+            allowed.headers.get("access-control-allow-origin")
+        ).is_equal_to(trusted)
+
+        denied = client.get("/health", headers={"Origin": "https://evil.example.com"})
+        assertpy.assert_that(denied.headers).does_not_contain_key(
+            "access-control-allow-origin"
+        )
+
+
+def test_cors_never_uses_wildcard(mock_feature_store):
+    """An untrusted origin is never reflected even when an allowlist is set."""
+    with _cors_client(
+        mock_feature_store, cors_origins=["https://feast.example.com"]
+    ) as client:
+        response = client.get(
+            "/health", headers={"Origin": "https://attacker.example.com"}
+        )
+        assertpy.assert_that(
+            response.headers.get("access-control-allow-origin")
+        ).is_none()
+
+
+def test_wildcard_cors_origin_is_allowed_but_warns(mock_feature_store, caplog):
+    """An explicit '*' is honored (informed opt-in) but logs a warning.
+
+    We intentionally do not reject '*': it is a deliberate, documented operator
+    choice for local development (mirroring Feast's own `auth_type=no_auth`).
+    The warning makes the risk visible so it can't be set unknowingly.
+    """
+    import logging
+
+    with caplog.at_level(logging.WARNING, logger="feast.ui_server"):
+        with _cors_client(mock_feature_store, cors_origins=["*"]) as client:
+            response = client.get(
+                "/health", headers={"Origin": "https://any.example.com"}
+            )
+
+    assertpy.assert_that(response.status_code).is_equal_to(EXPECTED_SUCCESS_STATUS)
+    assertpy.assert_that(caplog.text.lower()).contains("allow all origins")
+
+
 @patch("feast.ui_server.uvicorn")
 @patch("feast.ui_server.get_app")
 def test_start_server_dual_stack_binds_prebuilt_socket(mock_get_app, mock_uvicorn):