CVE-2026-82026: Radar Missing Authorization RCE Vulnerability

CVE-2026-82026 Overview

CVE-2026-82026 is a missing authorization vulnerability [CWE-862] in Radar versions prior to 1.12.2. The flaw resides in the handleLocalTerminal WebSocket endpoint exposed at /api/local-terminal. The endpoint relies solely on a runtime-mode check rather than role-based access control. Attackers can connect to the endpoint and spawn /bin/bash -l on the Radar host. The spawned shell inherits Radar's kubeconfig and process credentials, enabling remote code execution with Radar's privileges. The flaw persists even when operators set the --disable-local-terminal flag, nullifying the intended hardening control.

Critical Impact
Authenticated or unauthenticated attackers can obtain a privileged interactive shell on the Radar host with full kubeconfig access, enabling cluster-wide compromise.

Affected Products

Radar (skyhook-io/radar) versions before 1.12.2
Deployments exposing the /api/local-terminal WebSocket endpoint
Instances relying on the --disable-local-terminal flag for protection

Discovery Timeline

2026-10-14 - CVE-2026-82026 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-82026

Vulnerability Analysis

Radar exposes a WebSocket endpoint at /api/local-terminal handled by the handleLocalTerminal function. The handler gates access using a runtime-mode check instead of validating the caller's role or session claims. Any client that can reach the endpoint can open the WebSocket and request a shell. The handler then invokes /bin/bash -l on the host, injecting Radar's kubeconfig and process environment into the shell session. The resulting interactive shell runs with Radar's own privileges and credentials. Because the authorization logic bypasses the --disable-local-terminal configuration flag, administrators who believed they had hardened the deployment remain exposed.

Root Cause

The root cause is a missing authorization check [CWE-862] in the WebSocket handler. The code enforces a mode-based decision but never consults role-based access control (RBAC) policies before spawning the shell. The disable flag is also not honored at the handler level, leaving the endpoint reachable regardless of configuration intent.

Attack Vector

The attack vector is network-based and requires only low complexity. An attacker establishes a WebSocket connection to /api/local-terminal on the Radar instance. Once connected, the attacker interacts with the spawned bash session, executing arbitrary commands with Radar's kubeconfig loaded. This grants direct access to the Kubernetes cluster that Radar manages, enabling lateral movement, workload tampering, and secret exfiltration. Technical details are documented in the VulnCheck Advisory: Radar API Authorization and the upstream fixes in GitHub Pull Request #1534 and GitHub Pull Request #1537.

Detection Methods for CVE-2026-82026

Indicators of Compromise

Unexpected inbound WebSocket connections to the /api/local-terminal path on Radar hosts.
Child bash processes spawned by the Radar service with the -l login flag.
Outbound Kubernetes API calls originating from the Radar host using Radar's kubeconfig at unusual times.
Shell command history or audit records showing privileged kubectl activity initiated from Radar's service account.

Detection Strategies

Monitor HTTP and WebSocket access logs for requests to /api/local-terminal, correlating client IPs against known administrator sources.
Enable Linux process auditing (auditd or eBPF) to flag bash processes whose parent is the Radar binary.
Alert on Kubernetes API server audit logs showing Radar service account activity outside expected automation windows.

Monitoring Recommendations

Forward Radar application logs, host process telemetry, and Kubernetes audit logs to a centralized SIEM for correlation.
Baseline normal Radar network behavior and alert on new or anonymous WebSocket clients.
Track all shell invocations on Radar hosts and investigate any that originate from the web process tree.

How to Mitigate CVE-2026-82026

Immediate Actions Required

Upgrade Radar to version 1.12.2 or later as described in the GitHub Release v1.12.2 notes.
Restrict network access to the Radar management interface using firewalls, service meshes, or ingress controls.
Rotate Radar's kubeconfig credentials and any Kubernetes service account tokens exposed to the Radar host.
Review Kubernetes audit logs for suspicious activity using Radar's identity since the endpoint first became reachable.

Patch Information

The upstream fix is included in Radar 1.12.2. The code changes are published in GitHub Pull Request #1534 and GitHub Pull Request #1537, which add role-based access control enforcement to the handleLocalTerminal endpoint and ensure the --disable-local-terminal flag is honored.

Workarounds

Block external access to the /api/local-terminal path at a reverse proxy or ingress layer until patching is complete.
Reduce the privileges granted to Radar's kubeconfig, scoping it to the minimum RBAC permissions required.
Deploy Radar behind an authenticating proxy that enforces strong identity verification on all /api/* routes.

bash

# Example NGINX ingress snippet to block the vulnerable endpoint
location /api/local-terminal {
    deny all;
    return 403;
}