Vulnerability · Published Oct 9, 2026 · Assigned by ProgressSoftware

CVE-2026-106145Privilege Escalation in Telerik Report Server Service-Agent Hub

High 7.1

In plain English

A high-severity security flaw in Telerik Report Server from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.1%top 96.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.

Affected products (as reported)

Vendor	Product	Versions
Progress Software	Telerik Report Server	0 – before 12.2.26.1007

Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-privilege-assignment-cve-2026-106145 vendor-advisory