Improper Input Validation Vulnerability (CVE-2026-119102)
Description
November 2026 - CVE-2026-119102
- Telerik UI for Blazor 15.2.0 or earlier.
What Are the Impacts
In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist.
Issue
- CWE-20: Improper Input Validation
- CAPEC-153: Input Data Manipulation
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 12.0.0 && <= 15.2.0 | >= 16.0.0 |
Follow the update instructions for precise instructions. All customers who have a license for Telerik UI for Blazor can access their downloads here Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their cooperation and responsible disclosure.
External References
CVE-2026-119102 (6.5)
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
In Telerik UI for Blazor, versions prior to 16.0.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)