CVE-2026-13184

Analyzed Analyzed - Analysis Complete

Telerik UI for AJAX Predictable Upload Metadata Key

Publication date: 2026-07-22

Last updated on: 2026-08-06

Assigner: Progress Software Corporation

Description

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13184

EUVD

EUVD-2026-47689

Affected Vendors & Products

Vendor	Product	Version / Range
progress	telerik_ui_for_asp.net_ajax	From 2010.1309 (inc) to 2026.2.708 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability affects Progress Telerik UI for AJAX versions before 2026.2.708. If the Telerik.Upload.ConfigurationHashKey setting is missing and the machineKey is not explicitly set, the system may use a predictable default key for upload metadata integrity checks. Attackers can exploit this to forge protected upload metadata, potentially leading to unauthorized actions or further attacks.

Detection Guidance

Check if your Telerik UI for AJAX version is prior to v2026.2.708 by inspecting the assembly version in your application or logs. Review server configurations for the presence of Telerik.Upload.ConfigurationHashKey or explicit machineKey settings in web.config files.

Impact Analysis

Attackers could forge upload metadata to bypass security controls, upload malicious files, or trigger deserialization vulnerabilities. This may lead to remote code execution, data breaches, or system compromise if exploited in applications using vulnerable Telerik UI versions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations and potential fines.

Mitigation Strategies

Upgrade Telerik UI for AJAX to v2026.2.708 or later. Ensure Telerik.Upload.ConfigurationHashKey is explicitly configured in the application settings. If not using Telerik, verify machineKey is properly set in web.config to prevent fallback to predictable defaults.

Hi! I’m here to help you understand CVE-2026-13184. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70