CVE-2026-108116 — MDX and SOAP Injection in Kendo UI for jQuery

CVE-2026-108116

MDX and SOAP Injection in Kendo UI for jQuery PUBLISHED

Description (CNA)

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.

Affected (CNA)

Vendor / product	Versions
Progress Software / Kendo UI for jQuery	affected 2014.2.716 before 2026.3.1015

CWE

CWE-74

References

https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pivotgrid-mdx-soap-injection-cve-2026-108116

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.