CVE-2026-27478: Unity Catalog JWT Issuer Validation Bypass Enabling User Impersonation
CVE-2026-27478 affects Unity Catalog up to and including 0.4.0. Its token exchange endpoint uses the iss claim of incoming JWTs to choose where to fetch signing keys, without checking that the issuer is trusted, which the record links to complete user impersonation. The record gives a CVSS score of 9.1 (critical), and no confirmed exploitation appears in the sources consulted.
Overview
The record describes an authentication bypass in the token exchange endpoint of Unity Catalog. The endpoint reads the issuer claim of an incoming JWT and uses it to fetch the JWKS endpoint for signature validation, without confirming that the issuer is a trusted identity provider. The weakness is classified as CWE-290, Authentication Bypass by Spoofing.
Impact
- The record reports a CVSS score of 9.1 (critical) with high confidentiality and integrity impact and no availability impact.
- The title and advisory summary state that the issue allows complete user impersonation.
- The record's vector indicates network reachability, low complexity, no privileges and no user interaction, so exposed deployments are the main concern.
Affected products and versions
- Product: Unitycatalog Unitycatalog.
- Affected range: up to and including 0.4.0.
- The record does not list any fixed version.
Exploitation status
- The record shows this CVE is not listed in the CISA KEV catalog, so active exploitation is not confirmed by that source.
- No confirmed exploitation appears in the sources consulted.
- The record's SSVC fields show exploitation as none and automatable as yes. The EPSS probability is 0.00239 with percentile 0.14199, as recorded.
Remediation and mitigation
- Identify deployments running 0.4.0 or earlier and prioritize moving to a release that the maintainer documents as fixed. The record does not name one.
- Check the GitHub security advisory for current fix status and guidance.
- Until a fix is applied, restrict network access to the token exchange endpoint to trusted clients only.
- Treat tokens issued through exposed deployments as potentially untrustworthy until the impact is assessed.
Detection guidance
- Review logs for requests to the token exchange endpoint, especially from unexpected sources or involving unfamiliar issuers.
- Correlate successful authentications with unusual user or service activity in the catalog.
- Watch for outbound connections from the service to unexpected external identity or key endpoints, which could indicate key retrieval from untrusted issuers.
Limitations of the available information
- The record does not identify a fixed version or a confirmed patch.
- The record does not describe whether any environment was compromised.
- The EPSS date in the record (2026-10-23) is later than the published date (2026-03-11), so the EPSS values should be read with that in mind.
Frequently asked questions
Which versions of Unity Catalog are affected?
According to the record, versions up to and including 0.4.0 are affected. The record does not list a fixed version.
What does the vulnerability allow an attacker to do?
The record describes an authentication bypass in the token exchange endpoint that allows complete user impersonation. It assigns high confidentiality and integrity impact.
Is this vulnerability being actively exploited?
The record shows this CVE is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.