CVE-2026-10622: Collibra Agent Unauthenticated REST API Access (CVSS 8.2)

Technical summary

CVE-2026-10622 is an improper authentication vulnerability affecting Collibra Agent's REST API layer. Unauthenticated HTTP requests to `/rest/*` endpoints bypass authentication controls, granting access to privileged operations. The CVSS 3.1 vector (8.2 HIGH: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) indicates network-accessible endpoints with no special conditions or privileges required. The high confidentiality impact and lower integrity impact suggest data exfiltration risk with some modification capability, but no availability impact.

Business impact

Unauthorized access to Collibra Agent's administrative API exposes organizational metadata governance controls. Attackers could enumerate or exfiltrate sensitive data governance policies, lineage information, or compliance metadata without detection. The integrity component indicates potential for malicious modification of policies or data classifications, risking compliance violations and operational misconfiguration.

Affected systems

Collibra Agent deployments are affected. Specific affected versions and products are not detailed in available advisories. Organizations running Collibra Agent should immediately verify their installation version against vendor guidance and confirm whether their deployment exposes REST endpoints to untrusted networks.

Exploitability

This vulnerability is straightforward to exploit. No special conditions, authentication, or user interaction are required—an attacker only needs network access to the affected REST endpoints. The low attack complexity and absence of privilege requirements make this a practical risk for any Collibra Agent instance exposed to the internet or an untrusted network segment. As of the published date, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, though active exploitation in the wild cannot be ruled out.

Remediation

Apply vendor patches or mitigations as documented by Collibra. Verify patch availability and version compatibility. As an interim control, restrict network access to REST endpoints using firewall rules or reverse proxy authentication. Place Collibra Agent behind a WAF or API gateway enforcing authentication. Review access logs for suspicious unauthenticated API calls.

Patch guidance

Consult Collibra's official security advisory for available patches and affected versions. Apply patches to all Collibra Agent instances after testing in a non-production environment. Verify successful patching by confirming that `/rest/*` endpoints now reject unauthenticated requests with proper HTTP 401 or 403 responses. Note: specific patch version numbers should be verified against the vendor advisory.

Detection guidance

Monitor access logs and API request logs for unauthenticated calls to `/rest/*` endpoints, particularly those with administrative intent (user creation, policy modification, data export). Watch for HTTP 200 or 201 responses to requests lacking Authorization headers. Implement alerting for failed or successful authentication bypass attempts. Network IDS signatures may detect reconnaissance of REST endpoints. Review outbound data flows for unusual exfiltration patterns.

Why prioritize this

The combination of network accessibility, zero authentication requirements, and high confidentiality impact makes this a critical-priority remediation. Administrative REST API access is a high-value target; any unauthenticated access to such endpoints represents a material risk to governance and compliance posture. Prioritize patching or network isolation immediately, especially for Collibra deployments storing sensitive business metadata or regulatory classifications.

Risk score, explained

CVSS 3.1 score of 8.2 (HIGH) reflects the ease of exploitation (network-accessible, no authentication, no user interaction) combined with substantial confidentiality impact and some integrity risk. The vector emphasizes that this is a remote, low-complexity attack requiring no privileges. Confidentiality is rated 'high' due to unrestricted access to administrative API functions; integrity is 'low' because modification capability is present but not the primary impact. Availability is not impacted.

Frequently asked questions