CVE-2026-106145— Privilege Escalation in Telerik Report Server Service-Agent Hub
Quick assessment
Affected
Progress Software Telerik Report Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 In Progress® Telerik® Report Server 12.2.26.1007 版本之前，由于服务代理（service-agent）SignalR 中心存在错误权限分配漏洞，攻击者可以使用经过认证的用户（包括拥有有效承载令牌的低权限或访客账户）注册为受信任的服务代理。在下一次服务器设置同步事件发生时，恶意代理将接收到存储配置和加密私钥。该权限提升漏洞会导致受保护的秘密信息泄露，包括已存储的数据源凭据和连接字符串，同时允许攻击者冒充代理并干扰任务调度。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106145
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Privilege Escalation in Telerik Report Server Service-Agent Hub
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权授予不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Telerik Report Server | 0 ~ 12.2.26.1007 | - |
|
II. Public POCs for CVE-2026-106145
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106145
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-106145 (1)
IV. Related Vulnerabilities
Same product: Telerik Report Server
-
CVE-2026-106155
Stored Cross-site Scripting (XSS) in Telerik Report Server W -
CVE-2025-0556
Telerik Report Server Clear Text Transmission of Agent Comma -
CVE-2024-7295
Hard-coded credentials used for temporary and cache data enc -
CVE-2024-7292
Account Controller allows high count of login attempts -
CVE-2024-7294
Uncontrolled resource consumption of anonymous endpoints
Same vendor: Progress Software
-
CVE-2026-106155
Stored Cross-site Scripting (XSS) in Telerik Report Server W -
CVE-2026-106164
Infinite Loop in Telerik Document Processing XLS Import -
CVE-2026-91140
OS command injection in Progress Software Autonomous REST Co -
CVE-2026-92931
CWE-918: Server-Side Request Forgery in the Progress Sitefin -
CVE-2026-77805
Weak Executable Signature Verification Vulnerability in Prog
Same weakness: CWE-266
-
CVE-2026-96539
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escal -
CVE-2026-105070
WordPress Salon booking system plugin <= 10.31.7 - Privilege -
CVE-2026-105058
WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escal -
CVE-2026-104757
WordPress Import and export users and customers plugin <= 2. -
CVE-2026-104405
WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vul
V. Comments for CVE-2026-106145
No comments yet