CVE-2026-124702: URL Redirection to Untrusted Site in Progress Telerik UI for WPF
Published Nov 12, 2026
·Updated
In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.
Event History
Nov 12, 2026
CVE Published
via MITRE·05:23 PM
Data Sourced
via MITRE·05:23 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
The attacker must provide a crafted document or hyperlink using a URI scheme that is not allowlisted, and a user must open it. Exploitation can then launch an operating system protocol handler with attacker-controlled arguments.
2
Are users exposed simply by having Telerik UI for WPF installed?
The described attack requires user interaction: the user must open the attacker-crafted document or hyperlink. The vulnerability affects Telerik UI for WPF versions prior to 2026.4.1110.