Read the docs
TI-2026-09129 Aliases CVE-2026-10622GHSA-qhxc-r9rq-h2gw

Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated…

Priority MEDIUM 42Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated attacker to access privileged functionality via exposed '/rest/* endpoints.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00442 38th percentileScored 2026-11-07
Fix Fixed Collibra Platform (on-prem) (Collibra): 2026.03.356, 2025.10.399Collibra Platform (SaaS) (Collibra): 2026.04.5, 2026.03.4, 2026.02.6 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CollibraCollibra Platform (on-prem)2026.03 to before 2026.03.3562026.03.356Patch availableCNA
CollibraCollibra Platform (on-prem)2025.10 to before 2025.10.3992025.10.399Patch availableCNA
CollibraCollibra Platform (SaaS)2026.04 to before 2026.04.52026.04.5Patch availableCNA
CollibraCollibra Platform (SaaS)2026.03 to before 2026.03.42026.03.4Patch availableCNA
CollibraCollibra Platform (SaaS)2026.02 to before 2026.02.62026.02.6Patch availableCNA
CollibraCollibra Platform (SaaS)2025.11 to before 2025.11.72025.11.7Patch availableCNA
CollibraCollibra Platform (SaaS)2025.10 to before 2025.10.92025.10.9Patch availableCNA
  • Collibra Platform (on-prem) VendorCollibra Affected 2026.03 to before 2026.03.356 Fixed in 2026.03.356 Patch available CNA
  • Collibra Platform (on-prem) VendorCollibra Affected 2025.10 to before 2025.10.399 Fixed in 2025.10.399 Patch available CNA
  • Collibra Platform (SaaS) VendorCollibra Affected 2026.04 to before 2026.04.5 Fixed in 2026.04.5 Patch available CNA
  • Collibra Platform (SaaS) VendorCollibra Affected 2026.03 to before 2026.03.4 Fixed in 2026.03.4 Patch available CNA
  • Collibra Platform (SaaS) VendorCollibra Affected 2026.02 to before 2026.02.6 Fixed in 2026.02.6 Patch available CNA
  • Collibra Platform (SaaS) VendorCollibra Affected 2025.11 to before 2025.11.7 Fixed in 2025.11.7 Patch available CNA
  • Collibra Platform (SaaS) VendorCollibra Affected 2025.10 to before 2025.10.9 Fixed in 2025.10.9 Patch available CNA

Remediation

  • Fix · CNA Collibra Platform (on-prem) (Collibra) Fixed in 2026.03.356
  • Fix · CNA Collibra Platform (on-prem) (Collibra) Fixed in 2025.10.399
  • Fix · CNA Collibra Platform (SaaS) (Collibra) Fixed in 2026.04.5
  • Fix · CNA Collibra Platform (SaaS) (Collibra) Fixed in 2026.03.4
  • Fix · CNA Collibra Platform (SaaS) (Collibra) Fixed in 2026.02.6
  • Fix · CNA Collibra Platform (SaaS) (Collibra) Fixed in 2025.11.7
  • Fix · CNA Collibra Platform (SaaS) (Collibra) Fixed in 2025.10.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Collibra Platform (SaaS), Collibra Platform (on-prem) 2025.10.399, 2025.10.9 and 4 more versions

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-09128 Path traversal in restore handler in Collibra Agent, allows an attacker to write…Priority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-10622
  2. 2026-10-03 Alias added: GHSA-qhxc-r9rq-h2gw

References

Other 2

  • TI-2026-09128 Path traversal in restore handler in Collibra Agent, allows an attacker to write… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences