PT-2026-24800 · Maven+2 · Io.Unitycatalog:Unitycatalog-Server+1

Lukas-Reining · Published 2026-03-11 · Updated 2026-05-13 · CVE-2026-27478

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Unity Catalog versions 0.4.0 and earlier

Description Unity Catalog is an open, multi-modal Catalog for data and AI. A critical authentication bypass exists in the Unity Catalog token exchange endpoint, /api/1.0/unity-control/auth/tokens. The endpoint extracts the issuer (iss) claim from incoming JWTs and uses it to dynamically fetch the JWKS endpoint for signature validation without validating that the issuer is a trusted identity provider. This allows an attacker to forge any user identity by pointing validation to their own JWKS endpoint.

Recommendations Versions prior to 0.4.0 should be used.

Exploit

Fix

Authentication Bypass by Spoofing

Origin Validation Error

Weakness Enumeration

CWE-1390

CWE-290

CWE-346

Related Identifiers

CVE-2026-27478

GHSA-QQCJ-RGHW-829X

Affected Products

Io.Unitycatalog:Unitycatalog-Server

Unitycatalog

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27478.json · Exploit
• https://github.com/unitycatalog/unitycatalog/security/advisories/GHSA-qqcj-rghw-829x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27478 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qqcj-rghw-829x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27478 · Security Note
• https://github.com/unitycatalog/unitycatalog/releases/tag/v0.4.1 · Note
• https://github.com/unitycatalog/unitycatalog · Note
• https://twitter.com/0dayPublishing/status/2031820966527955104 · Twitter Post
• https://twitter.com/UpwindMDR/status/2053909913437405205 · Twitter Post
• https://twitter.com/CVEnew/status/2031867672757928078 · Twitter Post
• https://twitter.com/TechTranslators/status/2054553625540645044 · Twitter Post
• https://t.me/cveNotify/155561 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1tb1tta/resumen_diario_de_vulnerabilidades_12052026 · Reddit Post
• https://twitter.com/CveFindCom/status/2031832868930937240 · Twitter Post