{"id":"CVE-2026-82026","summary":"Radar \u003c 1.12.2 Missing Authorization via /api/local-terminal","details":"Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.","modified":"2026-10-15T02:48:03.507187257Z","published":"2026-10-14T12:37:18.610Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82026.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-862"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82026.json"},{"type":"PACKAGE","url":"https://github.com/skyhook-io/radar"},{"type":"REPORT","url":"https://github.com/skyhook-io/radar/pull/1534"},{"type":"REPORT","url":"https://github.com/skyhook-io/radar/pull/1537"},{"type":"FIX","url":"https://github.com/skyhook-io/radar/releases/tag/v1.12.2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82026"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/radar-missing-authorization-via-api-local-terminal"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/skyhook-io/radar","events":[{"introduced":"0"},{"fixed":"7d377d19a14cd4ed31b66ad4ce443bb10cda8ef7"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"fixed":"1.12.2"}]}}],"versions":["v1.12.1","radar-app-v1.12.2","k8s-ui-v1.13.3","radar-app-v1.12.1","k8s-ui-v1.13.2","v1.12.0","radar-app-v1.12.0","pkg/v1.12.1","k8s-ui-v1.13.1","v1.11.0","radar-app-v1.11.0","pkg/v1.12.0","k8s-ui-v1.13.0","v1.10.0","radar-app-v1.10.0","pkg/v1.11.0","k8s-ui-v1.12.0","v1.9.2","radar-app-v1.9.7","k8s-ui-v1.11.0","v1.9.1","radar-app-v1.9.6","k8s-ui-v1.10.5","pkg/v1.10.2","pkg/v1.10.1","pkg/v1.10.0","v1.9.0","radar-app-v1.9.5","pkg/v1.9.0","k8s-ui-v1.10.4","k8s-ui-v1.10.3","radar-app-v1.9.4","k8s-ui-v1.10.2","radar-app-v1.9.3","radar-app-v1.9.2","k8s-ui-v1.10.1","v1.8.7","radar-app-v1.9.1","k8s-ui-v1.9.1","k8s-ui-v1.10.0","radar-app-v1.9.0","k8s-ui-v1.9.0","radar-app-v1.8.13","v1.8.6","radar-app-v1.8.12","pkg/v1.8.9","k8s-ui-v1.8.15","radar-app-v1.8.11","radar-app-v1.8.10","pkg/v1.8.8","k8s-ui-v1.8.14","radar-app-v1.8.9","k8s-ui-v1.8.13","v1.8.5","v1.8.4","v1.8.3","v1.8.2","radar-app-v1.8.8","pkg/v1.8.7","k8s-ui-v1.8.12","radar-app-v1.8.7","pkg/v1.8.6","k8s-ui-v1.8.11","v1.8.1","radar-app-v1.8.6","pkg/v1.8.5","k8s-ui-v1.8.10","radar-app-v1.8.5","k8s-ui-v1.8.9","radar-app-v1.8.4","k8s-ui-v1.8.8","v1.8.0","radar-app-v1.8.3","pkg/v1.8.4","k8s-ui-v1.8.7","radar-app-v1.8.2","pkg/v1.8.3","k8s-ui-v1.8.6","radar-app-v1.8.1","k8s-ui-v1.8.5","radar-app-v1.8.0","k8s-ui-v1.8.4","radar-app-v1.7.0","k8s-ui-v1.8.3","radar-app-v1.6.2","pkg/v1.8.2","k8s-ui-v1.8.2","radar-app-v1.6.1","pkg/v1.8.1","k8s-ui-v1.8.1","radar-app-v1.6.0","pkg/v1.8.0","k8s-ui-v1.8.0","v1.7.9","v1.7.8","radar-app-v1.5.0","pkg/v1.7.9","k8s-ui-v1.7.15","radar-app-v1.4.2","pkg/v1.7.8","k8s-ui-v1.7.14","v1.7.7","radar-app-v1.4.1","pkg/v1.7.7","k8s-ui-v1.7.13","v1.7.6","radar-app-v1.4.0","pkg/v1.7.6","k8s-ui-v1.7.12","v1.7.5","v1.7.4","radar-app-v1.3.5","pkg/v1.7.5","k8s-ui-v1.7.11","k8s-ui-v1.7.10","v1.7.3","radar-app-v1.3.4","pkg/v1.7.4","k8s-ui-v1.7.9","radar-app-v1.3.3","pkg/v1.7.3","k8s-ui-v1.7.8","radar-app-v1.3.2","k8s-ui-v1.7.7","k8s-ui-v1.7.6","radar-app-v1.3.1","k8s-ui-v1.7.5","v1.7.2","radar-app-v1.3.0","pkg/v1.7.2","k8s-ui-v1.7.4","v1.7.1","radar-app-v1.2.3","pkg/v1.7.1","k8s-ui-v1.7.3","radar-app-v1.2.2","k8s-ui-v1.7.2","radar-app-v1.2.1","k8s-ui-v1.7.1","v1.7.0","radar-app-v1.2.0","pkg/v1.7.0","k8s-ui-v1.7.0","radar-app-v1.1.2","k8s-ui-v1.6.2","v1.6.2","radar-app-v1.1.1","k8s-ui-v1.6.1","v1.6.0","radar-app-v1.1.0","pkg/v1.6.0","k8s-ui-v1.6.0","v1.5.13","v1.5.12","radar-app-v1.0.1","pkg/v1.5.7","k8s-ui-v1.5.12","v1.5.11","v1.5.10","v1.5.9","v1.5.8","radar-app-v1.0.0","pkg/v1.5.6","k8s-ui-v1.5.11","radar-app-v0.2.2","k8s-ui-v1.5.10","radar-app-v0.2.1","k8s-ui-v1.5.9","v1.5.7","radar-app-v0.2.0","pkg/v1.5.5","k8s-ui-v1.5.8","radar-app-v0.1.9","v1.5.6","radar-app-v0.1.8","k8s-ui-v1.5.7","pkg/v1.5.4","k8s-ui-v1.5.6","v1.5.5","radar-app-v0.1.6","k8s-ui-v1.5.5","radar-app-v0.1.5","pkg/v1.5.3","k8s-ui-v1.5.4","v1.5.4","pkg/v1.5.2","k8s-ui-v1.5.3","v1.5.3","pkg/v1.5.1","k8s-ui-v1.5.2","v1.5.2","pkg/v1.5.0","k8s-ui-v1.5.1","radar-app-v0.1.3","v1.5.1","v1.5.0","radar-app-v0.1.2","radar-app-v0.1.1","radar-app-v0.1.0","k8s-ui-v1.5.0","v1.4.8","v1.4.7","v1.4.6","v1.4.5","v1.4.4","pkg/v1.4.3","k8s-ui-v1.4.3","v1.4.3","pkg/v1.4.2","k8s-ui-v1.4.2","v1.4.2","pkg/v1.4.1","k8s-ui-v1.4.1","v1.4.1","v1.4.0","pkg/v1.4.0","k8s-ui-v1.4.0","v1.3.4","k8s-ui-v1.3.2","v1.3.3","pkg/v1.3.1","k8s-ui-v1.3.1","v1.3.2","v1.3.1","v1.3.0","pkg/v1.3.0","k8s-ui-v1.3.0","k8s-ui-v1.2.3","k8s-ui-v1.2.2","v1.2.4","k8s-ui-v1.2.1","v1.2.3","v1.2.2","pkg/v1.2.0","k8s-ui-v1.2.0","v1.2.1","v1.2.0","pkg/v1.1.3","v1.1.4","v1.1.3","pkg/v1.1.2","k8s-ui-v1.1.1","v1.1.2","v1.1.1","v1.1.0","pkg/v1.1.1","k8s-ui-v1.1.0","pkg/v1.0.7","k8s-ui-v1.0.0","pkg/v1.1.0","v1.0.6","v1.0.5","v1.0.4-rc1","v1.0.3","v1.0.1","v1.0.0","v0.9.17","v0.9.16","v0.9.15","v0.9.14","v0.9.12","v0.9.11","v0.9.10","v0.9.9","v0.9.8","v0.9.7","v0.9.6","v0.9.5","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.8.2","v0.8.1","v0.8.0","v0.7.7","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.6.11","v0.7.1","v0.7.0","v0.6.10","v0.6.9","v0.6.8","v0.6.6","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.0","v0.4.2","v0.4.1","v0.4.0","v0.3.0","v0.2.2","v0.2.1","v0.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82026.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}