The vulnerability arises in Telerik UI for ASP.NET AJAX when the ConfigurationHashKey is absent and no explicit machineKey is set. Under these conditions, the upload metadata integrity protection mechanism falls back to a predictable default key. This predictable key can be exploited by attackers to forge protected upload metadata, which may lead to additional attack vectors. The affected version explicitly identified is 2010.1.309. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

The vulnerability does not directly compromise confidentiality or availability but allows attackers to forge upload metadata, impacting the integrity of the upload process. This integrity compromise can enable attackers to unlock further exploit chains, potentially leading to more severe security breaches depending on the application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should explicitly configure the machineKey setting and ensure Telerik.Upload.ConfigurationHashKey is properly set to prevent fallback to a predictable default key. Monitoring vendor communications for updates is recommended.