Vulnerability in Progress Software Telerik Report Server

[ Description ]Official description

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund8 Oct 2026WID-SEC-2026-3823

  Progress Software Telerik Report Server: Multiple vulnerabilities Translated from German

  CVE-2026-106145CVE-2026-106155

[ References ]References

• www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-privil…