Executive brief
Collibra Agent, a component used to manage and sync data assets within the Collibra Data Intelligence Platform, contains a security flaw that allows unauthorized individuals to access administrative functions. By exploiting this vulnerability, an attacker can bypass login requirements to interact with sensitive system settings. This can be further used to gain full control over the server, potentially leading to the theft of corporate data or a complete service shutdown.
Technical details
The Collibra Agent REST API fails to properly enforce authentication or authorization on endpoints located under the '/rest/*' path. A remote, unauthenticated attacker can exploit this by sending direct HTTP requests to these endpoints to interact with sensitive application functionality. This vulnerability is often chained with CVE-2026-10621 (a Zip Slip vulnerability in the restore handler) to achieve remote code execution. Additionally, the service may bind to all network interfaces regardless of installation settings, increasing the attack surface. Patches have been released for both SaaS and Self-Hosted versions.
Affected products
- Collibra Collibra Platform (SaaS) Prior to 2026.05, 2026.04.5, 2026.03.4, 2026.02.6, 2025.11.7, 2025.10.9
- Collibra Collibra Platform Self-Hosted Prior to 2026.03 (Build 2026.03.356), 2025.10 (Build 2025.10.399)
Timeline
- 2026-03-06: other: Vendor notified
- 2026-06-02: disclosed: Public disclosure by CERT/CC
- 2026-06-02: patched: Fixed versions released