{"cve":"CVE-2026-27478","nvd":{"published":"2026-03-11T20:16:14.810","modified":"2026-06-17T10:27:13.377","status":"Analyzed","description":"Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.0/unity-control/auth/tokens). The endpoint extracts the issuer (iss) claim from incoming JWTs and uses it to dynamically fetch the JWKS endpoint for signature validation without validating that the issuer is a trusted identity provider.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1},"cwes":["CWE-290","CWE-346","CWE-1390"],"references":["https://github.com/unitycatalog/unitycatalog/security/advisories/GHSA-qqcj-rghw-829x"],"products":["unitycatalog:unitycatalog"],"source":"nvd","synced_at":"2026-10-19T22:25:53.701907451+00:00"},"epss":{"cve":"CVE-2026-27478","score":0.0019,"percentile":0.08692,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-qqcj-rghw-829x","url":"https://osv.dev/vulnerability/GHSA-qqcj-rghw-829x","summary":"Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation","modified":"2026-05-11T18:19:20.413658Z","packages":[{"ecosystem":"Maven","name":"io.unitycatalog:unitycatalog-server","purl":"pkg:maven/io.unitycatalog/unitycatalog-server","ranges":["<0.4.1"],"fixed":["0.4.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}