CVE-2026-82026: Radar < 1.12.2 Missing Authorization via /api/local-terminal
Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Radarto a version that resolves this vulnerability.Fixed in 1.12.2
Event History
Frequently Asked Questions
Who can exploit the affected endpoint?
Both authenticated and unauthenticated attackers can connect to the /api/local-terminal WebSocket endpoint. No role-based authorization is enforced before a privileged shell is spawned.
Does disabling the local terminal feature prevent exploitation?
No. The issue is exploitable even when the --disable-local-terminal flag is set, because the endpoint relies on a runtime-mode check rather than authorization.
What level of access does successful exploitation provide?
An attacker can execute /bin/bash -l on the Radar host with Radar's process credentials and kubeconfig injected into the shell environment. This results in remote code execution with Radar's privileges.
Which versions are affected?
Radar versions before 1.12.2 are affected. Version 1.12.2 is identified as the fixed release.