CVE-2026-82026
Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal…
- Risk score
- 65/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.9%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect t…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.12.2 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
References
Original description
Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.
Last activity 14 Oct 2026. Patch Forecast updates every hour.