CVE-2026-27478

Description

Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.0/unity-control/auth/tokens). The endpoint extracts the issuer (iss) claim from incoming JWTs and uses it to dynamically fetch the JWKS endpoint for signature validation without validating that the issuer is a trusted identity provider.

PUBLISHED Reserved 2026-02-19 | Published 2026-03-11 | Updated 2026-03-12 | Assigner GitHub_M

Problem types

CWE-290: Authentication Bypass by Spoofing

CWE-346: Origin Validation Error

CWE-1390: Weak Authentication

Product status

References

github.com/...atalog/security/advisories/GHSA-qqcj-rghw-829x

cve.org (CVE-2026-27478)

nvd.nist.gov (CVE-2026-27478)

Download JSON