Privilege Escalation in In Progress Telerik Report Server by Unauthorized Users

CVE-2026-106145

What is CVE-2026-106145?

In Progress Telerik Report Server prior to version 12.2.26.1007 exposes a security flaw that allows authenticated users, including low-privilege and guest accounts, to gain elevated privileges through the service-agent SignalR hub. This vulnerability permits these users to register as trusted service agents, enabling them to receive sensitive storage settings and encryption keys during server synchronization events. Consequently, this unauthorized access can lead to the disclosure of confidential information such as data-source credentials and connection strings, allowing for potential impersonation of agents and interference with scheduled tasks.

References