External Control of Configuration Setting in Telerik Report Server (CVE-2026-106152)
Description
October 2026 - CVE-2026-106152
- Progress® Telerik® Report Server versions
>= 0and< 12.3.26.1110. - Embedded Telerik Reporting is not affected.
What Are the Impacts
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote user to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.
Issue
- CWE-15: External Control of System or Configuration Setting
- CAPEC-176: Configuration/Environment Manipulation
Solution
The issue is fixed in version 12.3.26.1110. The Progress Telerik team strongly recommends upgrading to this version or later.
| Current Version | Update to |
|---|---|
>= 0 and < 12.3.26.1110 | >= 12.3.26.1110 |
After upgrading: Administrators should verify that the Server URL in the Report Server configuration contains the correct public address of the server and set it explicitly if necessary.
Follow the Report Server upgrade instructions for precise instructions. All customers who have a license for Progress® Telerik® Report Server can access their downloads here: Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-106152 (High)
CVSS: 8.8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote user to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.