CVE-2026-13184: Telerik UI for AJAX Auth Bypass Flaw

CVE-2026-13184 Overview

CVE-2026-13184 affects Progress Telerik UI for AJAX versions prior to v2026.2.708. The vulnerability occurs when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured. Under these conditions, upload metadata integrity protection falls back to a predictable default key. Attackers can forge protected upload metadata and unlock further exploit chains, including the well-documented RadAsyncUpload (RAU) unauthenticated deserialization pathway. The weakness is classified under [CWE-321] Use of Hard-coded Cryptographic Key.

Critical Impact
Remote attackers can forge signed upload metadata without authentication, enabling deserialization-based exploit chains that compromise integrity of ASP.NET AJAX applications.

Affected Products

Progress Telerik UI for AJAX versions prior to v2026.2.708
ASP.NET applications embedding the RadAsyncUpload control without an explicit machineKey
Deployments missing the Telerik.Upload.ConfigurationHashKey application setting

Discovery Timeline

2026-07-22 - CVE-2026-13184 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13184

Vulnerability Analysis

The RadAsyncUpload control in Telerik UI for AJAX signs and encrypts upload metadata to preserve integrity between client requests and the server. Signing keys are normally derived from either the Telerik.Upload.ConfigurationHashKey application setting or the ASP.NET machineKey. When both values are missing, the control falls back to a predictable default key baked into the framework. Attackers who identify a vulnerable endpoint can generate metadata blobs signed with this known key. The server accepts the forged payload as authentic because integrity verification succeeds. Forged metadata then feeds directly into the file upload handler, which processes attacker-controlled parameters such as destination paths and serialized configuration objects.

Root Cause

The root cause is a hard-coded cryptographic fallback key used when application-level key material is not configured. Integrity protection relies on the secrecy of this key, but the default value is discoverable through static analysis of the library. Any deployment that omits both configuration options collapses to this shared secret, eliminating the authenticity guarantee.

Attack Vector

Exploitation requires only network access to the upload endpoint. The attacker crafts an HTTP POST request to the RadAsyncUpload handler containing metadata signed with the default key. No authentication or user interaction is needed. Successful forgery enables downstream attacks, including insecure deserialization chains previously documented in Telerik RAU advisories. Consult the Telerik Security Advisory CVE-2026-13184 for the full exploitation context.

Detection Methods for CVE-2026-13184

Indicators of Compromise

Unexpected POST requests to Telerik.Web.UI.WebResource.axd or Telerik.Web.UI.SpellCheckHandler.axd endpoints containing rauPostData parameters
Upload handler requests originating from external IPs targeting type=rau operations
New files written to temporary upload directories outside normal application workflow
ASP.NET worker process (w3wp.exe) spawning unexpected child processes shortly after upload activity

Detection Strategies

Inspect IIS logs for requests to Telerik async upload handlers that lack a corresponding authenticated user session
Audit web.config files across ASP.NET deployments to identify hosts missing both Telerik.Upload.ConfigurationHashKey and an explicit <machineKey> element
Monitor for anomalous deserialization exceptions in application event logs, which often accompany failed exploit attempts

Monitoring Recommendations

Enable request body logging on WAFs in front of ASP.NET applications hosting Telerik controls
Alert on process creation events where w3wp.exe launches cmd.exe, powershell.exe, or scripting hosts
Track file writes to IIS application directories and Telerik temporary folders for unexpected executable content

How to Mitigate CVE-2026-13184

Immediate Actions Required

Upgrade Progress Telerik UI for AJAX to v2026.2.708 or later
Configure an explicit, cryptographically strong machineKey in web.config for every affected ASP.NET application
Set a unique Telerik.Upload.ConfigurationHashKey value in application settings if the upgrade cannot be immediately applied
Restrict network access to Telerik upload handlers where the functionality is not required

Patch Information

Progress released a fix in Telerik UI for AJAX v2026.2.708. The patched version removes the predictable fallback and enforces explicit key configuration. Refer to the Telerik Security Advisory CVE-2026-13184 for the official remediation guidance.

Workarounds

Define a unique machineKey with strong validationKey and decryptionKey values in each application's web.config
Add the Telerik.Upload.ConfigurationHashKey application setting with a high-entropy value if patching is delayed
Disable the RadAsyncUpload control on internet-facing applications that do not require file upload functionality
Block requests to Telerik upload handlers at the WAF or reverse proxy for endpoints where uploads are not a business requirement

bash

# Configuration example: web.config hardening for Telerik UI for AJAX
<configuration>
  <appSettings>
    <add key="Telerik.Upload.ConfigurationHashKey" value="REPLACE_WITH_HIGH_ENTROPY_SECRET" />
    <add key="Telerik.AsyncUpload.ConfigurationEncryptionKey" value="REPLACE_WITH_HIGH_ENTROPY_SECRET" />
  </appSettings>
  <system.web>
    <machineKey
      validationKey="REPLACE_WITH_64_BYTE_HEX"
      decryptionKey="REPLACE_WITH_32_BYTE_HEX"
      validation="HMACSHA256"
      decryption="AES" />
  </system.web>
</configuration>