CVE-2026-82026
- Source
- https://cve.org/CVERecord?id=CVE-2026-82026
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82026.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-82026
- Published
- 2026-10-14T12:37:18Z
- Modified
- 2026-10-28T02:30:45Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Radar < 1.12.2 Missing Authorization via /api/local-terminal
- Details
-
Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82026.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82026.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-82026
- https://www.vulncheck.com/advisories/radar-missing-authorization-via-api-local-terminal
- https://github.com/skyhook-io/radar/pull/1534
- https://github.com/skyhook-io/radar/pull/1537
- https://github.com/skyhook-io/radar/releases/tag/v1.12.2
- https://github.com/skyhook-io/radar
Affected packages
Git / github.com/skyhook-io/radar
Affected ranges
- Type
- GIT
- Repo
- https://github.com/skyhook-io/radar
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "1.12.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "original_tag": "v1.12.2", "range": [ { "fixed": "7d377d19a14cd4ed31b66ad4ce443bb10cda8ef7" } ], "source": "REFERENCES_TAG" }, { "range": [ { "introduced": "0" }, { "fixed": "1.12.2" } ], "source": "DESCRIPTION" } ] }
Affected versions
k8s-ui-v1.*
k8s-ui-v1.0.0
k8s-ui-v1.1.0
k8s-ui-v1.1.1
k8s-ui-v1.10.0
k8s-ui-v1.10.1
k8s-ui-v1.10.2
k8s-ui-v1.10.3
k8s-ui-v1.10.4
k8s-ui-v1.10.5
k8s-ui-v1.11.0
k8s-ui-v1.12.0
k8s-ui-v1.13.0
k8s-ui-v1.13.1
k8s-ui-v1.13.2
k8s-ui-v1.13.3
k8s-ui-v1.2.0
k8s-ui-v1.2.1
k8s-ui-v1.2.2
k8s-ui-v1.2.3
k8s-ui-v1.3.0
k8s-ui-v1.3.1
k8s-ui-v1.3.2
k8s-ui-v1.4.0
k8s-ui-v1.4.1
k8s-ui-v1.4.2
k8s-ui-v1.4.3
k8s-ui-v1.5.0
k8s-ui-v1.5.1
k8s-ui-v1.5.10
k8s-ui-v1.5.11
k8s-ui-v1.5.12
k8s-ui-v1.5.2
k8s-ui-v1.5.3
k8s-ui-v1.5.4
k8s-ui-v1.5.5
k8s-ui-v1.5.6
k8s-ui-v1.5.7
k8s-ui-v1.5.8
k8s-ui-v1.5.9
k8s-ui-v1.6.0
k8s-ui-v1.6.1
k8s-ui-v1.6.2
k8s-ui-v1.7.0
k8s-ui-v1.7.1
k8s-ui-v1.7.10
k8s-ui-v1.7.11
k8s-ui-v1.7.12
k8s-ui-v1.7.13
k8s-ui-v1.7.14
k8s-ui-v1.7.15
k8s-ui-v1.7.2
k8s-ui-v1.7.3
k8s-ui-v1.7.4
k8s-ui-v1.7.5
k8s-ui-v1.7.6
k8s-ui-v1.7.7
k8s-ui-v1.7.8
k8s-ui-v1.7.9
k8s-ui-v1.8.0
k8s-ui-v1.8.1
k8s-ui-v1.8.10
k8s-ui-v1.8.11
k8s-ui-v1.8.12
k8s-ui-v1.8.13
k8s-ui-v1.8.14
k8s-ui-v1.8.15
k8s-ui-v1.8.2
k8s-ui-v1.8.3
k8s-ui-v1.8.4
k8s-ui-v1.8.5
k8s-ui-v1.8.6
k8s-ui-v1.8.7
k8s-ui-v1.8.8
k8s-ui-v1.8.9
k8s-ui-v1.9.0
k8s-ui-v1.9.1
pkg/v1.*
pkg/v1.0.7
pkg/v1.1.0
pkg/v1.1.1
pkg/v1.1.2
pkg/v1.1.3
pkg/v1.10.0
pkg/v1.10.1
pkg/v1.10.2
pkg/v1.11.0
pkg/v1.12.0
pkg/v1.12.1
pkg/v1.2.0
pkg/v1.3.0
pkg/v1.3.1
pkg/v1.4.0
pkg/v1.4.1
pkg/v1.4.2
pkg/v1.4.3
pkg/v1.5.0
pkg/v1.5.1
pkg/v1.5.2
pkg/v1.5.3
pkg/v1.5.4
pkg/v1.5.5
pkg/v1.5.6
pkg/v1.5.7
pkg/v1.6.0
pkg/v1.7.0
pkg/v1.7.1
pkg/v1.7.2
pkg/v1.7.3
pkg/v1.7.4
pkg/v1.7.5
pkg/v1.7.6
pkg/v1.7.7
pkg/v1.7.8
pkg/v1.7.9
pkg/v1.8.0
pkg/v1.8.1
pkg/v1.8.2
pkg/v1.8.3
pkg/v1.8.4
pkg/v1.8.5
pkg/v1.8.6
pkg/v1.8.7
pkg/v1.8.8
pkg/v1.8.9
pkg/v1.9.0
radar-app-v0.*
radar-app-v0.1.0
radar-app-v0.1.1
radar-app-v0.1.2
radar-app-v0.1.3
radar-app-v0.1.5
radar-app-v0.1.6
radar-app-v0.1.8
radar-app-v0.1.9
radar-app-v0.2.0
radar-app-v0.2.1
radar-app-v0.2.2
radar-app-v1.*
radar-app-v1.0.0
radar-app-v1.0.1
radar-app-v1.1.0
radar-app-v1.1.1
radar-app-v1.1.2
radar-app-v1.10.0
radar-app-v1.11.0
radar-app-v1.12.0
radar-app-v1.12.1
radar-app-v1.12.2
radar-app-v1.2.0
radar-app-v1.2.1
radar-app-v1.2.2
radar-app-v1.2.3
radar-app-v1.3.0
radar-app-v1.3.1
radar-app-v1.3.2
radar-app-v1.3.3
radar-app-v1.3.4
radar-app-v1.3.5
radar-app-v1.4.0
radar-app-v1.4.1
radar-app-v1.4.2
radar-app-v1.5.0
radar-app-v1.6.0
radar-app-v1.6.1
radar-app-v1.6.2
radar-app-v1.7.0
radar-app-v1.8.0
radar-app-v1.8.1
radar-app-v1.8.10
radar-app-v1.8.11
radar-app-v1.8.12
radar-app-v1.8.13
radar-app-v1.8.2
radar-app-v1.8.3
radar-app-v1.8.4
radar-app-v1.8.5
radar-app-v1.8.6
radar-app-v1.8.7
radar-app-v1.8.8
radar-app-v1.8.9
radar-app-v1.9.0
radar-app-v1.9.1
radar-app-v1.9.2
radar-app-v1.9.3
radar-app-v1.9.4
radar-app-v1.9.5
radar-app-v1.9.6
radar-app-v1.9.7
v0.*
v0.2.0
v0.2.1
v0.2.2
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.6.0
v0.6.1
v0.6.10
v0.6.11
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.6.8
v0.6.9
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.8.0
v0.8.1
v0.8.2
v0.9.1
v0.9.10
v0.9.11
v0.9.12
v0.9.14
v0.9.15
v0.9.16
v0.9.17
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9
v1.*
v1.0.0
v1.0.1
v1.0.3
v1.0.4-rc1
v1.0.5
v1.0.6
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.10.0
v1.11.0
v1.12.0
v1.12.1
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.5.0
v1.5.1
v1.5.10
v1.5.11
v1.5.12
v1.5.13
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.5.9
v1.6.0
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.9.0
v1.9.1
v1.9.2