URL Redirection to Untrusted Site Vulnerability (CVE-2026-124702)
Description
November 2026 - CVE-2026-124702
- Telerik UI for WPF 2026 Q3 (2026.3.1007) or earlier.
What Are the Impacts
In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to direct users to an unintended external resource.
Issue
- CWE-601: URL Redirection to Untrusted Site
- CAPEC-194: Fake the Source of Data
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 0 && <= 2026.3.1007 | >= 2026.4.1110 |
To upgrade using the Telerik UI for WPF Visual Studio extension, follow the update instructions. Customers with a Telerik UI for WPF license can access their downloads on the Product Downloads | Your Account page.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-124702 (High)
CVSS: 7.8
In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to direct users to an unintended external resource.