What is the CVSS score of CVE-2026-27478?

CVE-2026-27478 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of AI / ML are affected by CVE-2026-27478?

A critical authentication bypass vulnerability in Unity Catalog versions 0.4.0 and earlier allows attackers to obtain valid tokens without proper credentials, potentially granting unauthorized access…. A patch is available.

Is there a public PoC exploit available for CVE-2026-27478?

Yes, a public proof-of-concept exploit is available for CVE-2026-27478. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27478?

Within 24 hours: Inventory all systems running Unity Catalog 0.4.0 or earlier and isolate them from production networks if possible; enable enhanced logging on token exchange endpoints (/api/1.0/unity-control/auth/tokens). Within 7 days: Implement network-level access controls restricting token endpoint access to authorized IPs only; conduct forensic review of authentication logs for suspicious token requests. Within 30 days: Upgrade to a patched version when available; evaluate alternative catalog solutions if upgrade timeline extends beyond 30 days.

AI / ML CVE-2026-27478

EUVD-2026-11304 CRITICAL

Authentication Bypass by Spoofing (CWE-290)

2026-03-11 security-advisories@github.com

GHSA-qqcj-rghw-829x

Authentication Bypass AI / ML

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 20:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.0/unity-control/auth/tokens). The endpoint extracts the issuer (iss) claim from incoming JWTs and uses it to dynamically fetch the JWKS endpoint for signature validation without validating that the issuer is a trusted identity provider.