Security Advisory

CVE-2026-27478

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-03-11 19:36:03

Last updated 2026-03-12 19:57:39

Assigner GitHub_M

CVSS score 9.1

State PUBLISHED

Description

Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.0/unity-control/auth/tokens). The endpoint extracts the issuer (iss) claim from incoming JWTs and uses it to dynamically fetch the JWKS endpoint for signature validation without validating that the issuer is a trusted identity provider.

← Browse all CVEs View on cve.org ↗