EUVD-2026-11304
GHSA-qqcj-rghw-829x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft JWT with untrusted issuer claim
-
DeliverySubmit to token exchange endpoint
-
ExploitEndpoint fetches attacker-controlled JWKS
-
ExecutionValidate forged JWT signature
-
ImpactBypass authentication and gain access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Unity Catalog versions 0.4.0 and earlier with token exchange endpoint (/api/1.0/unity-control/auth/tokens) enabled. Attacker must control a domain that can host a malicious JWKS endpoint referenced in the JWT issuer claim. No authentication or special configuration required. |
| Impact | CVSS 9.1. Data catalog for ML/AI. |
| Exploit ScenarioDerived | Bypass auth to access data catalog. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Auth bypass in Unity Catalog 0.4.0 and earlier.
Earlier versions of this analysis (1)
Auth bypass in Unity Catalog.
RemediationAI
Update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-290.
Know when AI / ML gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.0/unity-control/auth/tokens). The endpoint extracts the issuer (iss) claim from incoming JWTs and uses it to dynamically fetch the JWKS endpoint for signature validation without validating that the issuer is a trusted identity provider.
Executive ViewAI
A critical authentication bypass vulnerability in Unity Catalog versions 0.4.0 and earlier allows attackers to obtain valid tokens without proper credentials, potentially granting unauthorized access to sensitive data and AI assets. Organizations using affected versions face immediate risk of data breaches and unauthorized system access, with no patch currently available.
Deploy WAF rules to block suspicious requests to /api/1.0/unity-control/auth/tokens endpoint; implement IP-based access controls limiting token endpoint access to internal networks only; disable Unity Catalog token exchange feature if not actively required; segment Unity Catalog systems from sensitive data repositories; enforce multi-factor authentication for all catalog access; implement real-time alerting for failed authentication attempts and token generation anomalies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
MCPJam Inspector versions 1.4.2 and earlier allow unauthenticated remote code execution through missing authentication i
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Sandbox escape in Enclave JavaScript sandbox before 2.11.1. Enclave is designed for safe AI agent code execution — the e
enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Er
A remote code execution vulnerability in langchain-ai/langchain (CVSS 10.0). Risk factors: public PoC available. Vendor
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary fil
WeKnora LLM framework (before 0.2.5) allows authenticated users to inject MCP stdio commands that the server executes as
OS command injection in WeKnora from version 0.2.5 allows authenticated users to execute arbitrary system commands. CVSS
Exploit-DB