CVE-2026-106145 Details
Description
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.
A privilege escalation vulnerability has been identified in Progress Telerik Report Server versions prior to 12.2.26.1007. The issue arises from incorrect privilege assignment in the service-agent SignalR hub, allowing an authenticated user, including those with low privileges or guest accounts holding a valid bearer token, to register as a trusted service agent. Once registered, the rogue agent can intercept storage settings and encryption private keys during the next server settings synchronization event. This exploitation leads to unauthorized access to protected secrets, such as stored data-source credentials and connection strings, and enables agent impersonation and disruption of task dispatch.
Users are advised to upgrade to Progress Telerik Report Server version 12.2.26.1007 or later. Follow the Report Server upgrade instructions available on the Telerik website. All customers with a valid license can access the updated version through the Telerik Product Downloads portal.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-privilege-assignment-cve-2026-106145 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Progress Telerik Report Server | >= 0, < 12.2.26.1007 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |