{"id":"CVE-2026-106146","kind":"vulnerability","aliases":["CVE-2026-106146"],"related":[],"title":"Telerik UI for ASP.NET MVC: crafted filter input causes unhandled server errors","description":"In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version `2026.4.1111`.","summary":"Telerik UI for ASP.NET MVC mishandles crafted server-side filter parameters, so unvalidated input throws uncaught casting and null-reference exceptions. The report describes HTTP 500 responses and does not show code execution or process termination.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asp.net","dotnet","package","telerik","web-apps"],"not_affected_if":["auth-required","unaffected-version"],"how_to_check":"- Check the installed Telerik.UI.for.AspNet.Mvc package version in the project file or `packages.config`\n- Look for public endpoints that pass filter parameters to Telerik grid or data-source filtering","fix":"- Telerik UI for ASP.NET MVC: move to `2026.4.1111` or later (affected range `2012.2.710` through `2026.3.1015`)","status":"open","published_at":"2026-11-12T18:17:12+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","triaged_at":"2026-11-12T18:42:44+00:00","updated_at":"2026-11-12T18:42:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T18:42:44Z","model":"claude-haiku-5-5","output":{"fix":"- Telerik UI for ASP.NET MVC: move to `2026.4.1111` or later (affected range `2012.2.710` through `2026.3.1015`)","reach":"internet","title":"Telerik UI for ASP.NET MVC: crafted filter input causes unhandled server errors","impact":"low","summary":"Telerik UI for ASP.NET MVC mishandles crafted server-side filter parameters, so unvalidated input throws uncaught casting and null-reference exceptions. The report describes HTTP 500 responses and does not show code execution or process termination.","audience":"developers","category":"package","nicknames":[],"who_cares":["asp.net","telerik","dotnet","web-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated requests cause HTTP 500 errors on affected endpoints","analyst_note":"","how_to_check":"- Check the installed Telerik.UI.for.AspNet.Mvc package version in the project file or `packages.config`\n- Look for public endpoints that pass filter parameters to Telerik grid or data-source filtering","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","unaffected-version"],"who_is_affected":"Applications built on Telerik UI for ASP.NET MVC in the listed version range that expose an endpoint without authentication accepting filter parameters. Applications without such an endpoint, or running outside the affected range, are not exposed according to the report.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000746,"input_tokens":4699,"output_tokens":553,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-106146':15A,18A '-2026':14A,17A '2012.2.710':72C '2026.3.1015':74C '2026.4.1111':161C '500':53B,140C 'accept':119C 'affect':100C,123C 'app':25B 'applic':111C 'asp.net':4A,19B,29B,69C 'assembl':101C 'attack':105C 'authent':117C 'cast':43B,128C 'catch':96C 'caus':9A 'code':59B 'craft':6A,32B,120C 'cve':13A,16A 'demonstr':145C 'describ':51B 'descriptor':84C 'disrupt':151C 'dotnet':20B 'empti':134C 'empty-stack':133C 'endpoint':114C 'error':12A 'except':48B,136C 'execut':60B 'exploit':107C 'expos':112C 'filter':7A,36B,78C,121C 'filternodevisitor':92C 'filterparserexcept':97C 'fix':158C 'http':52B,139C 'input':8A,40B 'issu':156C 'mishandl':31B 'mvc':5A,30B,70C 'null':46B,86C,130C 'null-refer':45B,129C 'packag':21B 'paramet':37B,122C 'process':62B,79C,148C 'progress':65C 'proper':82C 'reachabl':115C 'refer':47B,131C 'remot':104C 'report':50B,142C 'request':124C,154C 'respons':54B 'return':138C 'server':11A,34B,76C 'server-sid':33B,75C 'show':58B 'side':35B,77C 'stack':89C,135C 'state':90C 'telerik':1A,22B,26B,66C 'termin':63B,149C 'throw':41B 'trigger':126C 'type':85C 'ui':2A,27B,67C 'unauthent':103C 'uncaught':42B,127C 'unhandl':10A 'unrel':153C 'unvalid':39B 'valid':83C 'valu':87C 'version':71C,160C 'web':24B 'web-app':23B 'within':98C 'without':116C 'worker':147C 'worker-process':146C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Telerik UI for ASP.NET MVC in the listed version range that expose an endpoint without authentication accepting filter parameters. Applications without such an endpoint, or running outside the affected range, are not exposed according to the report.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspnet","dotnet","high","package","telerik","webapps"],"campaign_type":null,"search_a":"'-106146':15A,18A '-2026':14A,17A 'asp.net':4A 'caus':9A 'craft':6A 'cve':13A,16A 'error':12A 'filter':7A 'input':8A 'mvc':5A 'server':11A 'telerik':1A 'ui':2A 'unhandl':10A","search_b":"'500':53B 'app':25B 'asp.net':19B,29B 'cast':43B 'code':59B 'craft':32B 'describ':51B 'dotnet':20B 'except':48B 'execut':60B 'filter':36B 'http':52B 'input':40B 'mishandl':31B 'mvc':30B 'null':46B 'null-refer':45B 'packag':21B 'paramet':37B 'process':62B 'refer':47B 'report':50B 'respons':54B 'server':34B 'server-sid':33B 'show':58B 'side':35B 'telerik':22B,26B 'termin':63B 'throw':41B 'ui':27B 'uncaught':42B 'unvalid':39B 'web':24B 'web-app':23B","search_c":"'2012.2.710':72C '2026.3.1015':74C '2026.4.1111':161C '500':140C 'accept':119C 'affect':100C,123C 'applic':111C 'asp.net':69C 'assembl':101C 'attack':105C 'authent':117C 'cast':128C 'catch':96C 'craft':120C 'demonstr':145C 'descriptor':84C 'disrupt':151C 'empti':134C 'empty-stack':133C 'endpoint':114C 'except':136C 'exploit':107C 'expos':112C 'filter':78C,121C 'filternodevisitor':92C 'filterparserexcept':97C 'fix':158C 'http':139C 'issu':156C 'mvc':70C 'null':86C,130C 'null-refer':129C 'paramet':122C 'process':79C,148C 'progress':65C 'proper':82C 'reachabl':115C 'refer':131C 'remot':104C 'report':142C 'request':124C,154C 'return':138C 'server':76C 'server-sid':75C 'side':77C 'stack':89C,135C 'state':90C 'telerik':66C 'termin':149C 'trigger':126C 'type':85C 'ui':67C 'unauthent':103C 'uncaught':127C 'unrel':153C 'valid':83C 'valu':87C 'version':71C,160C 'within':98C 'without':116C 'worker':147C 'worker-process':146C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106146","severity":null,"published_at":"2026-11-12T18:17:12+00:00","modified_at":"2026-11-12T18:17:12+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","fetched_at":"2026-11-12T18:40:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}