Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Radar lets attackers run privileged shell

CVE-2026-82026 · published 1 day ago
Summary

Radar versions before 1.12.2 let anyone connect to a web endpoint and start a command‑line session with the program’s own permissions. This can give an attacker the ability to run commands on the server as Radar, exposing sensitive credentials and control over the Kubernetes cluster. Upgrade Radar to version 1.12.2 or later, or disable the local‑terminal feature if you cannot upgrade.

What to do
  • Update skyhook-io radar to version 1.12.2 or later.
Affected software
VendorProductAffected versions
skyhook-io radar < 1.12.2
Original advisory text
Radar < 1.12.2 Missing Authorization via /api/local-terminal
Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-82026 · NVD
CVE-2026-82026 · MITRE
CVE-2026-82026 · OSV
Track software like this
Free during beta