---
id: "CVE-2026-106146"
page: "https://infrastack.ai/live/CVE-2026-106146"
kind: "vulnerability"
aliases: ["CVE-2026-106146"]
title: "Telerik UI for ASP.NET MVC: crafted filter input causes unhandled server errors"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["asp.net", "dotnet", "package", "telerik", "web-apps"]
not_affected_if: ["auth-required", "unaffected-version"]
published_at: "2026-11-12T18:17:12+00:00"
first_seen_at: "2026-11-12T18:40:37+00:00"
updated_at: "2026-11-12T18:42:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106146", "first_seen_at": "2026-11-12T18:40:37+00:00"}]
exploit_sources: []
---

# Telerik UI for ASP.NET MVC: crafted filter input causes unhandled server errors

Link for people: https://infrastack.ai/live/CVE-2026-106146 (this .md is for agents)

Telerik UI for ASP.NET MVC mishandles crafted server-side filter parameters, so unvalidated input throws uncaught casting and null-reference exceptions. The report describes HTTP 500 responses and does not show code execution or process termination.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Telerik.UI.for.AspNet.Mvc package version in the project file or `packages.config`
- Look for public endpoints that pass filter parameters to Telerik grid or data-source filtering

## Fix

- Telerik UI for ASP.NET MVC: move to `2026.4.1111` or later (affected range `2012.2.710` through `2026.3.1015`)

## Timeline

- 2026-11-12T18:40:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106146

## From the sources

In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version `2026.4.1111`.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_