# CVE-2026-106145: Progress Telerik Report Server privilege escalation in service-agent SignalR hub

Source: https://junglewise.ai/threats/cve-2026-106145-in-progress-telerik-report-server-prior-to-version-12-2-26-1007  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-106145 · Severity: high · CVSS 7.1 · Published 2026-10-09

Telerik Report Server is a reporting platform used to generate and manage business reports. An authenticated user with low or guest privileges can impersonate a trusted service agent and gain access to encrypted storage settings and database credentials through a flaw in the SignalR hub's privilege checks. This allows attackers to steal sensitive secrets and interfere with scheduled task processing.

Technologies: [Progress Telerik Report Server](https://junglewise.ai/threats/technologies/telerik-report-server). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-106145 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106145 being exploited in the wild.

**How severe is CVE-2026-106145?** High severity, with a CVSS score of 7.1, published 9 October 2026.

**Which products and versions are affected?** Progress Telerik Report Server before 12.2.26.1007.

**Is there a fix for CVE-2026-106145?** Yes: fixed in 12.2.26.1007. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106145 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-106145?** Check whether you run Progress Telerik Report Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 12.2.26.1007

## Technical details

CWE-266 (incorrect privilege assignment) in the service-agent SignalR hub: the hub verifies authentication but fails to confirm the user is the dedicated service-agent system user, allowing any authenticated user to register as a trusted agent. On the next settings-synchronization event (server startup, admin save, or scheduled reload), the rogue agent receives encrypted storage settings and keys it can decrypt. This enables disclosure of data-source credentials and connection strings, and allows agent impersonation and task dispatch interference.

## Affected products

- Progress Telerik Report Server before 12.2.26.1007

## Timeline

- 2026-10-09: disclosed

## References

- [https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-privilege-assignment-cve-2026-106145](https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-privilege-assignment-cve-2026-106145)

## Related threats

- [Telerik Report Server external control of system configuration setting](https://junglewise.ai/threats/cve-2026-106152-in-progress-telerik-report-server-prior-to-version-12-3-26-1110)
- [Progress Telerik Report Server authorization bypass in Web Report Designer](https://junglewise.ai/threats/cve-2026-106133-in-progress-telerik-report-server-prior-to-version-12-3-26-1110)
- [Progress Telerik Report Server stored XSS in shared reporting engine](https://junglewise.ai/threats/cve-2026-106155-in-progress-telerik-report-server-prior-to-version-12-2-26-1007)
- [Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability](https://junglewise.ai/threats/cve-2024-4358-progress-telerik-report-server-authentication-bypass-by-spoofing)