CVE-2026-106152 · Vendor
NO FIX YET · SEE WHAT TO DO
Telerik Report Server before 12.3.26.1110 lets an unauthenticated remote attacker change the server address it uses when building links and notifications. With a user clicking a crafted link, an attacker can read sensitive information and take over accounts.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running Telerik Report Server before 12.3.26.1110 are exposed, particularly if the server is reachable from the internet or untrusted networks. The sources do not say which configurations are default, so whether a given install is exposed is unknown.
Not affected if patched-version
Who cares self-hosted, telerik-report-server, windows
12.3.26.111012.3.26.1110 or laterIn Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.