CVE-2026-10621: CVE-2026-10621

Synopsis

A path traversal vulnerability (commonly called a "Zip Slip" attack) affects the restore handler in Collibra Agent, part of the Collibra Platform. The flaw is reachable over the network without any authentication, and it stems from missing path canonicalization during ZIP archive extraction. Successful exploitation lets an attacker write arbitrary files to any location on the host filesystem, enabling configuration tampering, backdoor placement, or further system compromise. Patched-image rebuilds at versions 2024.04.5, 2025.10.9, 2025.10.399, 2025.11.7, and 2026.02.6 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The restore handler is exposed over the network, meaning an attacker must be able to reach the Collibra Agent service to deliver a crafted ZIP archive.

• AuthenticationNot required

  No credentials are needed; the CVSS vector specifies PR:N, so the restore endpoint can be targeted by any unauthenticated caller who can reach it.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from a user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is rated Low (AC:L), meaning the exploit is straightforward and reliable with no race conditions or special environmental prerequisites.

Blast Radius

• Attacker writes arbitrary files to any path on the host filesystem reachable by the Collibra Agent process.
• Attacker overwrites configuration files, startup scripts, or scheduled-task definitions to establish persistence or escalate privileges.
• Attacker places malicious executables or libraries in locations that are loaded by the platform at runtime.