CVE-2026-108116 MDX and SOAP Injection in Kendo UI for jQuery
Attackers can inject MDX or XML into SOAP requests via PivotGrid filters, potentially exposing data accessible through the XMLA connection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108116?
CVE-2026-108116 is a high-severity code injection vulnerability in Progress Software Kendo UI for jQuery, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
Weakness: CWE-74
Which versions are affected by CVE-2026-108116?
It affects 1 product.
Products include Progress Kendo Ui.
How do I fix CVE-2026-108116?
No fix has been published for CVE-2026-108116 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-108116 being exploited?
There is no known exploitation of CVE-2026-108116 in the wild and no public exploit code.
Other vulnerabilities in Progress Software Kendo UI for jQuery
- CVE-2026-106163 Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
- CVE-2018-14037 Cross-site scripting in n/a
- CVE-2026-106147 Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery
- CVE-2026-106148 Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery
- CVE-2026-106149 Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
Sources
Also known as GHSA-63f7-2qgh-c93c.