RadAsyncUpload Default HMAC Key Fallback Vulnerability (CVE-2026-13184)

Updated on Jul 22, 2026

Description

June 2026 - CVE-2026-13184

• Progress® Telerik® UI for AJAX 2026.2.519 or earlier.

What Are the Impacts

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata.

Is My Application Vulnerable?

Your application is vulnerable if RadAsyncUpload is used in the application and any of the following apply:

• machineKey is not explicitly configured in web.config or machine.config (left at default AutoGenerate).
• Telerik.AsyncUpload.ConfigurationEncryptionKey is set in web.config (activates a vulnerable code path).

Issue

• CWE-321: Use of Hard-coded Cryptographic Key
• CAPEC-586: Object Injection

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
>= 2010.1.309 && <= 2026.2.519 (2026 Q2)	>= 2026.2.708 (2026 Q2 SP1)

Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, apply the following measures to reduce risk.

The RELEVANT_KEY references below refers to any of Telerik.AsyncUpload.ConfigurationEncryptionKey, Telerik.Upload.ConfigurationHashKey, or Telerik.Web.UI.DialogParametersEncryptionKey in web.config.

Using v2026.2.514 and earlier:

• Vulnerable Scenario 1 - If you are using a RELEVANT_KEY in web.config
  1. Remove RELEVANT_KEY from web.config, to fall back on MachineKey.Unprotect with AES + HMAC
  2. Continue to Instructions - Generating Strong Machine Keys section
• Vulnerable Scenario 2 - If you are not using RELEVANT_KEY
  1. Continue to Instructions - Generating Strong Machine Keys section

Using v2026.2.708 and later:

• Option 1 - You can use RELEVANT_KEY again, it provides stronger protection than machineKey, via AES-GCM
• Option 2 - Remove RELEVANT_KEY to use machineKey, while not as strong as GCM, it is useful for webfarm environments, and you can use the "autogenerate keys at runtime" again.

Instructions - Generating Strong Machine Keys

AES + HMAC support and framework-managed key material via machine key config. even a strong custom key will not prevent padding oracle attacks. Critical - You must manually generate the keys in IIS, using the Autogenerate creates the same HMAC guard collapse as #1

1. Open IIS > select your site > select Machine Key
2. Validation method: choose HMACSHA256
3. Automatically generate at runtime checkboxes: uncheck both (important)
4. In the right pane, click Generate Keys 
5. In the right pane, click Apply
6. In the left pane, select Application Pools and recycle the relevant App Pool (important)

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank the researchers at TantoSec for their responsible disclosure and cooperation.

External References

CVE-2026-13184 (High)

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5)

In Progress® Telerik® UI for AJAX prior to v2026.2.708, fallback HMAC key behavior can allow forgery of protected upload metadata and enable chained exploitation.

Discoverer Credit: Marcio Almeida of TantoSec