CVE-2026-108116: MDX and SOAP Injection in Kendo UI for jQuery
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Kendo UI for jQueryto a version that resolves this vulnerability.Fixed in 2026.3.1015
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the PivotGrid XMLA transport in Progress Kendo UI for jQuery versions earlier than v2026.3.1015 are affected. Exposure depends on the application having a configured XMLA connection.
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without authentication or user interaction by supplying specially crafted PivotGrid filter values. The vulnerable handling can alter MDX predicates or inject XML markup into SOAP requests.
What data could be exposed?
The potential exposure is limited to data accessible through the XMLA connection configured for the affected PivotGrid. The provided information does not indicate integrity or availability impact.
What should be done to remediate it?
Upgrade Progress Kendo UI for jQuery to v2026.3.1015 or later. If an upgrade cannot be performed immediately, the provided data does not specify a workaround.