Telerik Report Server Privilege Escalation via SignalR Authentication

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability affects Progress Telerik Report Server versions prior to 12.2.26.1007 and represents a critical privilege escalation flaw in the service-agent SignalR hub. An authenticated user—even with minimal permissions like guest or low-privilege accounts—can exploit incorrect privilege assignment logic to register themselves as a trusted service agent. Upon the next server settings-synchronization event, the attacker gains access to sensitive encryption private keys and storage settings, effectively escalating their access from limited user to system-level agent. Organizations running vulnerable Telerik Report Server instances face immediate risk of credential disclosure, as attackers can extract stored data-source credentials and other protected secrets, potentially compromising downstream systems and data repositories.

Casky.ai's 224 mapped security skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this CVE, primarily focusing on MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would identify suspicious patterns including: unauthorized SignalR hub registrations from low-privilege accounts, anomalous bearer token validation bypass attempts, unexpected service-agent role assumptions during settings-synchronization events, and access to encryption key material by non-administrative accounts. The platform's skill-mapped detection logic would flag the sequence of authentication abuse followed by secrets access, correlating token validation failures with subsequent privilege elevation indicators. Security teams would surface findings showing the exact mechanism of exploitation—how a guest account transitions to trusted agent status—enabling rapid remediation before encryption keys or credentials are exfiltrated.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-106145.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-106145

Casky has 224 skills that investigate the attack patterns behind CVE-2026-106145. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn