CVE-2026-27478
Critical
Description
Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.0/unity-control/auth/tokens). The endpoint extracts the issuer (iss) claim from incoming JWTs and uses it to dynamically fetch the JWKS endpoint for signature validation without validating that the issuer is a trusted identity provider.
SeverityCritical
CVSS9.1
Exploit probability—
ProductUnitycatalog
PublishedMar 11, 2026
First seenMar 11, 2026
Weakness typeCWE-290CWE-290CWE-346CWE-346CWE-1390CWE-1390
How to fix
Update
- io.unitycatalog:unitycatalog-server0.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| unitycatalog unitycatalog | v ≤ 0.4.0 | — |
| io.unitycatalog:unitycatalog-serverMaven | v < 0.4.1 | 0.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.