CVE-2026-106146: Uncaught Exceptions in Telerik UI for ASP.NET MVC Filter Processing
In Progress® Telerik® UI for ASP.NET MVC versions 2012.2.710 through 2026.3.1015, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version 2026.4.1111.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik UI for ASP.NET MVCto a version that resolves this vulnerability.Fixed in 2026.4.1111
Event History
Frequently Asked Questions
Which applications are exposed to unauthenticated exploitation?
An application is exposed if it uses an affected Telerik UI for ASP.NET MVC version and has an endpoint reachable without authentication that accepts filter parameters. Endpoints that do not accept attacker-controlled filter parameters are not described as exploitable by this report.
What does an attacker need to send to trigger the issue?
The attacker needs to send crafted filter parameters to a reachable affected endpoint. No authentication, user interaction, or other prerequisites are identified.
What is the observed impact of a successful request?
Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and produce an HTTP 500 response. The report does not demonstrate worker-process termination or disruption of unrelated requests.
What version resolves the issue?
The issue is fixed in Telerik UI for ASP.NET MVC version 2026.4.1111. Versions from 2012.2.710 through 2026.3.1015 are affected.