MDX and SOAP Injection Vulnerability (CVE-2026-108116)
Description
Security Notification - October 2026 - CVE-2026-108116
- Progress® Kendo® UI for jQuery prior to
2026.3.1015.
What Are the Impacts
In affected versions of Progress® Kendo® UI for jQuery 2014.2.716 through 2026.3.811, in the PivotGrid XMLA transport, filter values for text-based operators were inserted into MDX string literals without escaping embedded quotes. The resulting MDX statement was also inserted into the SOAP request without XML-encoding its text. A crafted filter value could change the MDX predicate or introduce XML markup into the request, potentially exposing data available through the configured XMLA connection. The issue is fixed with 2026.3.1015.
Issue
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ("Injection")
Solution
The fix escapes embedded quotes in MDX string literals and XML-encodes values in the SOAP request. Upgrade to 2026.3.1015 or later.
| Current Version | Update to |
|---|---|
>=2014.2.716 && <=2026.3.811 | 2026.3.1015 or later |
Follow the update instructions for precise instructions. Customers with a license can access downloads from Product Downloads | Your Account.
Notes
- If you do not use the PivotGrid with an XMLA data source, your application is not affected.
- If you have questions or concerns about this issue, open a Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-108116 (HIGH)
CVSS: 7.5
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.