CVE-2026-106145 in Telerik Report Server
Summary
by MITRE • 10/09/2026
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Progress Telerik Report Server prior to version 12.2.26.1007 represents a critical failure in access control mechanisms within the service-agent SignalR hub architecture. This flaw stems from an incorrect privilege assignment that permits authenticated users, including those with low-privilege or guest accounts possessing valid bearer tokens, to register themselves as trusted service agents. In typical enterprise reporting environments, the distinction between end-user clients and backend service agents is fundamental to maintaining system integrity. Service agents are privileged components designed to interact directly with server infrastructure for tasks such as configuration synchronization and task execution. By allowing any authenticated entity to masquerade as one of these privileged agents, the application violates the principle of least privilege and fails to enforce proper role-based access control during the registration process.
The technical exploitation of this flaw involves an attacker authenticating to the system using standard credentials or a guest account with a valid token. Once authenticated, the attacker interacts with the SignalR hub endpoint responsible for registering service agents. Due to the lack of sufficient validation checks on the identity and authorization level of the requester, the server accepts the registration request without verifying that the user holds the necessary administrative privileges required for such an action. This misconfiguration effectively grants the low-privilege account elevated permissions equivalent to those of a system-level agent. The vulnerability is particularly severe because it does not require unauthenticated access; instead, it leverages existing valid credentials, which are often easier to obtain through phishing or credential stuffing attacks compared to exploiting zero-day vulnerabilities in authentication protocols.
The operational impact of this privilege escalation is profound and extends beyond simple unauthorized access. Upon successful registration as a trusted service agent, the rogue entity becomes part of the server's internal communication mesh. During the next scheduled settings-synchronization event, which occurs periodically to ensure consistency across distributed components, the malicious agent receives sensitive configuration data from the central server. This includes storage settings and, most critically, encryption private keys used by the system to protect stored secrets. The exposure of these cryptographic materials allows for the decryption of protected information that was previously considered secure at rest or in transit within the application layer.
With access to the encryption private keys, an attacker can decrypt sensitive data sources embedded within the report server configuration. This includes database connection strings and credentials used by reports to query backend databases. Consequently, this leads to a complete compromise of confidentiality for all data accessible through these connections. Furthermore, the ability to impersonate a trusted service agent allows the attacker to interfere with task dispatching mechanisms. The rogue agent can inject malicious tasks, disrupt legitimate report generation processes, or manipulate system behavior by sending forged commands that are indistinguishable from those issued by authorized administrative agents. This capability undermines both data integrity and availability, potentially leading to denial of service conditions or the execution of arbitrary code if the downstream systems process unvalidated inputs derived from these manipulated tasks.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, specifically regarding the failure to enforce role-based access controls for privileged operations. It also relates closely to CWE-862 Missing Authorization, as the application fails to verify that the user has the appropriate permissions before allowing them to perform a high-level action like registering a service agent. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior is consistent with T1078 Valid Accounts, where attackers use legitimate credentials to gain access, and potentially T1552 Unsecured Credentials if the decrypted keys are used for lateral movement or further exploitation against other systems using shared secrets.
Mitigation strategies must prioritize immediate patching of the Telerik Report Server software to version 12.2.26.1007 or later, where these access control checks have been corrected. In environments where patching is not immediately feasible, administrators should implement network-level restrictions on SignalR hub endpoints to limit access only from known internal IP ranges associated with legitimate service agents. Additionally, rotating all stored data-source credentials and regenerating encryption keys is essential after remediation to invalidate any potentially compromised secrets obtained during the window of vulnerability. Monitoring logs for unusual registration patterns or unexpected synchronization events can also aid in detecting exploitation attempts before significant damage occurs.