CVE-2026-10622: Collibra Agent Auth Bypass Vulnerability

CVE-2026-10622 Overview

CVE-2026-10622 is an improper authentication vulnerability in the Collibra Agent REST API. The flaw exposes /rest/* endpoints without enforcing authentication controls. A remote unauthenticated attacker can reach privileged functionality over the network. The issue affects the Collibra Agent component used to bridge on-premises data sources with the Collibra Data Intelligence Platform.

Critical Impact
Remote unauthenticated attackers can invoke privileged REST API functionality, leading to confidentiality loss and limited integrity impact on affected Collibra Agent deployments.

Affected Products

Collibra Agent (REST API component)
Deployments exposing /rest/* endpoints to untrusted networks
Environments referenced in CERT Vulnerability Advisory #873170

Discovery Timeline

2026-06-02 - CVE-2026-10622 published to the National Vulnerability Database (NVD)
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10622

Vulnerability Analysis

The Collibra Agent exposes a REST API under the /rest/* URI prefix. The API fails to enforce authentication on requests reaching these endpoints. An attacker sending crafted HTTP requests to the agent can invoke functions intended for authenticated, privileged users. The vulnerability is exploitable from the network with low attack complexity and requires no user interaction.

Successful exploitation yields high confidentiality impact and low integrity impact. The scope remains unchanged, and availability is not directly affected. According to EPSS data dated 2026-06-04, the probability of exploitation is 0.049% at the 15.677 percentile, indicating limited observed exploit activity at disclosure.

Root Cause

The root cause is missing or improperly applied authentication middleware on the /rest/* route handlers within the Collibra Agent. Privileged endpoints rely on the caller being authenticated, but the request pipeline does not consistently verify session tokens or credentials before dispatching to controller logic. This is a classic [CWE-287] Improper Authentication condition affecting an API surface.

Attack Vector

An attacker reaches the agent over HTTP or HTTPS on the network-accessible management port. The attacker issues requests directly to /rest/* URIs without supplying valid credentials. The agent processes the requests and executes privileged operations exposed by the API. No phishing, local access, or prior foothold is required. See the CERT Vulnerability Advisory #873170 for additional technical context.

No verified public proof-of-concept code is available at the time of writing. See the Collibra Security Insights portal for vendor-provided details.

Detection Methods for CVE-2026-10622

Indicators of Compromise

Unauthenticated HTTP requests to /rest/* paths on Collibra Agent hosts originating from unexpected source addresses
Agent access logs showing successful 2xx responses to privileged REST endpoints without a corresponding authenticated session
Outbound data transfers initiated by the agent shortly after anomalous inbound REST traffic

Detection Strategies

Enable verbose access logging on the Collibra Agent and forward logs to a centralized SIEM for correlation
Build detection rules that flag REST API responses with privileged status codes when the request lacks an Authorization header or session cookie
Baseline normal REST API callers and alert on requests from new or non-corporate IP ranges

Monitoring Recommendations

Monitor network flows to the Collibra Agent management port for traffic from outside expected administrative subnets
Track HTTP request rates per source against /rest/* URIs and alert on sudden enumeration patterns
Review configuration changes and exported datasets that may indicate post-exploitation activity

How to Mitigate CVE-2026-10622

Immediate Actions Required

Restrict network access to the Collibra Agent so that /rest/* endpoints are reachable only from trusted management networks
Place the agent behind a reverse proxy or web application firewall that enforces authentication before requests reach the agent
Audit recent access logs for unauthenticated requests to /rest/* and investigate any anomalies

Patch Information

Consult the Collibra Security Insights portal and CERT Vulnerability Advisory #873170 for the current fixed version of the Collibra Agent. Apply the vendor-supplied update as soon as it is released and validated in a non-production environment.

Workarounds

Block external access to the Collibra Agent listener using host-based firewall rules or network ACLs
Terminate REST traffic at an authenticating reverse proxy that rejects requests lacking valid credentials
Segment the agent into a management VLAN reachable only from administrator jump hosts

bash

# Example: restrict access to the Collibra Agent REST listener with iptables
# Replace <agent_port> with the configured REST port and <admin_cidr> with the trusted admin subnet
iptables -A INPUT -p tcp --dport <agent_port> -s <admin_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport <agent_port> -j DROP