{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"skyhook-io/radar","product":"radar","source":"CNA: VulnCheck","vendor":"skyhook-io","versions":[{"lessThan":"1.12.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-82026","cwes":["CWE-862"],"description":"Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.","epss":{"date":"2026-11-08","percentile":0.60664,"score":0.00924},"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.8,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794146947302,"publishedAt":1791981438610,"references":[{"source":"CNA: VulnCheck","tags":["release-notes","patch"],"url":"https://github.com/skyhook-io/radar/releases/tag/v1.12.2"},{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://github.com/skyhook-io/radar/pull/1534"},{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://github.com/skyhook-io/radar/pull/1537"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/radar-missing-authorization-via-api-local-terminal"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/skyhook-io/radar/releases/tag/v1.12.2"},{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/skyhook-io/radar/pull/1534"},{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/skyhook-io/radar/pull/1537"}],"revision":"2a5cb3d6fbb1cc46cddc4cce5e042ad0bcd91289e3a331f0e5ab055f78520aa6","sources":[{"modifiedAt":1794146947302,"name":"CNA: VulnCheck","retrievedAt":1794151382026,"url":"https://www.cve.org/CVERecord?id=CVE-2026-82026"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794151398889,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82026"}],"ssvc":{"assessedAt":1791989526620,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Radar < 1.12.2 Missing Authorization via /api/local-terminal","updatedAt":1794151398889}