CVE-2026-82026
8.8HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-862
Impact
Attackers can spawn an interactive root/privileged bash shell and execute arbitrary code with Radar's process and Kubernetes credentials. They only need network reachability to the WebSocket endpoint, as the check bypasses authentication and authorization.
Root cause
The /api/local-terminal WebSocket handler relies solely on a runtime-mode check instead of enforcing role-based access control, ignoring authentication and the --disable-local-terminal flag.
Affected systems
Radar versions prior to 1.12.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Radar to version 1.12.2 or later. If upgrading immediately is not possible, block or restrict network traffic to the /api/local-terminal path at your reverse proxy or ingress controller.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.