CVE-2026-27478: Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-11 · updated 2026-06-17
Weakness: CWE-290

Description

Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.0/unity-control/auth/tokens). The endpoint extracts the issuer (iss) claim from incoming JWTs and uses it to dynamically fetch the JWKS endpoint for signature validation without validating that the issuer is a trusted identity provider.

Affected products

unitycatalog: through 0.4.0

References

https://github.com/unitycatalog/unitycatalog/security/advisories/GHSA-qqcj-rghw-829x

Get alerted when CVE-2026-27478 or the next vulnerability affects your stack