CVE-2026-108116
7.5HighPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-74
Impact
Unauthenticated remote attackers can read sensitive data accessible via the configured XMLA connection. They only need network access to interact with the application using the affected PivotGrid component.
Root cause
Improper sanitization of user-supplied filter values in the PivotGrid XMLA transport allows MDX and SOAP injection.
Affected systems
Progress Kendo UI for jQuery prior to v2026.3.1015
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade Kendo UI for jQuery to version 2026.3.1015 or later. If upgrading immediately is not possible, disable the PivotGrid XMLA transport or sanitize incoming filter inputs before passing them to the XMLA transport.
$ npm install @progress/kendo-ui@^2026.3.1015AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.