{"action":"Upgrade io.unitycatalog:unitycatalog-server to 0.4.1 or later.","affected":[{"fixed":"0.4.1","introduced":"0"}],"component":"io.unitycatalog:unitycatalog-server","cve_ids":["CVE-2026-27478"],"ecosystem":"Maven","epss":0.0019,"exploited":false,"fixed_versions":["0.4.1"],"ghsa_id":"GHSA-qqcj-rghw-829x","id":"tcs_01M5N9A2ZQ15TGDWFNABERZW2P","modified_at":"2026-05-11T18:19:20.413658Z","published_at":"2026-05-11T17:58:40Z","references":["https://osv.dev/vulnerability/GHSA-qqcj-rghw-829x","https://github.com/unitycatalog/unitycatalog/security/advisories/GHSA-qqcj-rghw-829x","https://nvd.nist.gov/vuln/detail/CVE-2026-27478","https://github.com/unitycatalog/unitycatalog","https://github.com/unitycatalog/unitycatalog/releases/tag/v0.4.1"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-qqcj-rghw-829x","url":"https://osv.dev/vulnerability/GHSA-qqcj-rghw-829x"}],"summary":"Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation"}