CVE-2026-82026

Deferred Deferred - Pending Action

Unauthorized Shell Access in Radar Software

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-82026

EUVD

EUVD-2026-101018

Affected Vendors & Products

Vendor	Product	Version / Range
skyhook-io	radar	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authorization flaw in Radar versions before 1.12.2 affecting the /api/local-terminal WebSocket endpoint. It allows attackers, authenticated or not, to bypass role-based access controls by exploiting a runtime-mode check instead of proper role verification. This enables spawning a privileged shell with Radar's credentials, executing commands like /bin/bash -l, and achieving remote code execution even when the --disable-local-terminal flag is set.

Detection Guidance

To detect this vulnerability, check if your Radar instance is running a version prior to 1.12.2. Use commands like 'radar version' or inspect the running process to verify the version. Monitor WebSocket connections to the /api/local-terminal endpoint for unauthorized access attempts.

Impact Analysis

An attacker could gain full control over the Radar host system, execute arbitrary commands with high privileges, access sensitive data, or perform lateral movement within the network. This includes bypassing security controls, stealing credentials, or disrupting services. The impact is severe due to the high CVSS scores (8.7 v4.0, 8.8 v3.1) indicating significant risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected Radar versions may face compliance violations, regulatory penalties, and loss of trust due to potential data breaches or unauthorized system access.

Mitigation Strategies

Upgrade Radar to version 1.12.2 or later immediately. Ensure the --disable-local-terminal flag is properly enforced and test its effectiveness. Review WebSocket logs for suspicious connections to /api/local-terminal.

Hi! I’m here to help you understand CVE-2026-82026. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70