Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M
CVE-2026-27478Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation
Critical 9.1
In plain English
A critical-severity authentication bypass by spoofing in unitycatalog from unitycatalog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.0/unity-control/auth/tokens). The endpoint extracts the issuer (iss) claim from incoming JWTs and uses it to dynamically fetch the JWKS endpoint for signature validation without validating that the issuer is a trusted identity provider.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.unitycatalog:unitycatalog-server | 0.4.1 | GHSA-qqcj-rghw-829x |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| unitycatalog | unitycatalog | <= 0.4.0 |
Weakness: CWE-290, CWE-346, CWE-1390 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N