Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation

Vulnerability

Overview

The Unity Catalog token exchange endpoint (/api/1.0/unity-control/auth/tokens) contains a critical authentication bypass vulnerability in versions 0.4.0 and earlier. The endpoint extracts the iss (issuer) claim from incoming JWTs and dynamically fetches the JWKS endpoint for signature validation without verifying that the issuer is a trusted identity provider [1][3]. This design flaw allows an attacker to supply an arbitrary issuer URL that they control.

Exploitation

Method

An attacker can exploit this by hosting their own OIDC-compliant server with a valid JWKS endpoint. They then sign a JWT with their own private key, setting the iss claim to their server and the sub or email claim to any known user in the Unity Catalog system. This crafted token can be exchanged for a valid internal access token. Additionally, the implementation does not validate the aud (audience) claim, allowing tokens intended for other services to be reused [3].

Impact

Successful exploitation results in complete impersonation of any user in the system. The attacker gains access to all catalogs, schemas, tables, and other resources that the impersonated user has permissions to [3].

Mitigation

The vulnerability has been patched in Unity Catalog version 0.4.1 [4]. Users are strongly advised to upgrade to this version or later. No workarounds are documented; upgrading is the recommended action.