{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/unitycatalog-server/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:unitycatalog:unitycatalog:*:*:*:*:data:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-27478"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["unitycatalog-server"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","jwt","unity-catalog"],"_cs_type":"advisory","_cs_vendors":["Databricks"],"content_html":"\u003cp\u003eA critical authentication bypass vulnerability, tracked as CVE-2026-27478, has been identified in the token exchange endpoint (\u003ccode\u003e/api/1.0/unity-control/auth/tokens\u003c/code\u003e) of Unity Catalog. This vulnerability allows an attacker to completely impersonate any user within the system. The issue arises because the endpoint dynamically fetches the JWKS (JSON Web Key Set) for signature validation based on the issuer (\u003ccode\u003eiss\u003c/code\u003e) claim in incoming JWTs without validating whether the issuer is a trusted identity provider. Additionally, the implementation does not validate the audience (\u003ccode\u003eaud\u003c/code\u003e) claim, enabling tokens intended for other services to be used. This bypass has been observed in unitycatalog-server versions 0.4.0 and earlier. Successful exploitation grants unauthorized access to all catalogs, schemas, tables, and other resources accessible to the impersonated user.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker sets up their own OIDC-compliant server. This server needs to have a valid JWKS endpoint, serving the public key.\u003c/li\u003e\n\u003cli\u003eThe attacker generates an RSA key pair and creates a JWKS containing the public key.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious JWT. The \u003ccode\u003eiss\u003c/code\u003e claim is set to the attacker\u0026rsquo;s OIDC server URL. The \u003ccode\u003esub\u003c/code\u003e and \u003ccode\u003eemail\u003c/code\u003e claims are set to the email address of the target user in Unity Catalog. The \u003ccode\u003eaud\u003c/code\u003e claim is optionally set to a value other than \u0026ldquo;unity-catalog\u0026rdquo;.\u003c/li\u003e\n\u003cli\u003eThe crafted JWT is signed with the attacker\u0026rsquo;s private key, using the RS256 algorithm and including the key ID (\u003ccode\u003ekid\u003c/code\u003e) in the header.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a POST request to the Unity Catalog token exchange endpoint (\u003ccode\u003e/api/1.0/unity-control/auth/tokens\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe request includes the \u003ccode\u003egrant_type\u003c/code\u003e set to \u003ccode\u003eurn:ietf:params:oauth:grant-type:token-exchange\u003c/code\u003e, the \u003ccode\u003erequested_token_type\u003c/code\u003e set to \u003ccode\u003eurn:ietf:params:oauth:token-type:access_token\u003c/code\u003e, the \u003ccode\u003esubject_token_type\u003c/code\u003e set to \u003ccode\u003eurn:ietf:params:oauth:token-type:id_token\u003c/code\u003e, and the \u003ccode\u003esubject_token\u003c/code\u003e set to the crafted JWT.\u003c/li\u003e\n\u003cli\u003eThe Unity Catalog server retrieves the JWKS from the attacker\u0026rsquo;s OIDC server based on the \u003ccode\u003eiss\u003c/code\u003e claim. It then validates the JWT signature using the public key from the JWKS.\u003c/li\u003e\n\u003cli\u003eDue to the lack of issuer validation, the server trusts the attacker\u0026rsquo;s JWT and exchanges it for a valid internal access token, effectively impersonating the target user, and allowing unauthorized access to Unity Catalog resources.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-27478 allows an attacker to completely impersonate any user within the Unity Catalog system. This grants the attacker unauthorized access to all catalogs, schemas, tables, and other resources that the impersonated user has permissions to access. The vulnerability affects unitycatalog-server versions 0.4.0 and earlier, potentially impacting all organizations using these vulnerable versions. Data breaches, unauthorized data modification, and complete compromise of the Unity Catalog system are potential outcomes.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003emaven/io.unitycatalog:unitycatalog-server\u003c/code\u003e to a version later than 0.4.0 to remediate CVE-2026-27478.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for POST requests to \u003ccode\u003e/api/1.0/unity-control/auth/tokens\u003c/code\u003e with suspicious \u003ccode\u003esubject_token\u003c/code\u003e values, using the Sigma rule \u003ccode\u003eDetect Unity Catalog JWT Issuer Validation Bypass Attempt\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement strict validation of the \u003ccode\u003eiss\u003c/code\u003e claim in JWTs at the token exchange endpoint to ensure that only trusted identity providers are allowed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-11T17:59:40Z","date_published":"2026-05-11T17:59:40Z","id":"https://feed.craftedsignal.io/briefs/2026-05-unity-catalog-jwt-bypass/","summary":"A critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (CVE-2026-27478), allowing attackers to impersonate any user by forging JWTs with a self-controlled issuer and exchanging them for valid access tokens, granting unauthorized access to catalogs and other resources.","title":"Unity Catalog JWT Issuer Validation Bypass Allows User Impersonation (CVE-2026-27478)","url":"https://feed.craftedsignal.io/briefs/2026-05-unity-catalog-jwt-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed — Unitycatalog-Server","version":"https://jsonfeed.org/version/1.1"}