CVE-2026-82026

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82026
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82026.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82026
Published
2026-10-14T12:37:18Z
Modified
2026-10-15T02:48:03Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Radar < 1.12.2 Missing Authorization via /api/local-terminal
Details

Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82026.json"
}
References

Affected packages

Git / github.com/skyhook-io/radar

Affected ranges

Type
GIT
Repo
https://github.com/skyhook-io/radar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7d377d19a14cd4ed31b66ad4ce443bb10cda8ef7
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.12.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

k8s-ui-v1.*
k8s-ui-v1.0.0
k8s-ui-v1.1.0
k8s-ui-v1.1.1
k8s-ui-v1.10.0
k8s-ui-v1.10.1
k8s-ui-v1.10.2
k8s-ui-v1.10.3
k8s-ui-v1.10.4
k8s-ui-v1.10.5
k8s-ui-v1.11.0
k8s-ui-v1.12.0
k8s-ui-v1.13.0
k8s-ui-v1.13.1
k8s-ui-v1.13.2
k8s-ui-v1.13.3
k8s-ui-v1.2.0
k8s-ui-v1.2.1
k8s-ui-v1.2.2
k8s-ui-v1.2.3
k8s-ui-v1.3.0
k8s-ui-v1.3.1
k8s-ui-v1.3.2
k8s-ui-v1.4.0
k8s-ui-v1.4.1
k8s-ui-v1.4.2
k8s-ui-v1.4.3
k8s-ui-v1.5.0
k8s-ui-v1.5.1
k8s-ui-v1.5.10
k8s-ui-v1.5.11
k8s-ui-v1.5.12
k8s-ui-v1.5.2
k8s-ui-v1.5.3
k8s-ui-v1.5.4
k8s-ui-v1.5.5
k8s-ui-v1.5.6
k8s-ui-v1.5.7
k8s-ui-v1.5.8
k8s-ui-v1.5.9
k8s-ui-v1.6.0
k8s-ui-v1.6.1
k8s-ui-v1.6.2
k8s-ui-v1.7.0
k8s-ui-v1.7.1
k8s-ui-v1.7.10
k8s-ui-v1.7.11
k8s-ui-v1.7.12
k8s-ui-v1.7.13
k8s-ui-v1.7.14
k8s-ui-v1.7.15
k8s-ui-v1.7.2
k8s-ui-v1.7.3
k8s-ui-v1.7.4
k8s-ui-v1.7.5
k8s-ui-v1.7.6
k8s-ui-v1.7.7
k8s-ui-v1.7.8
k8s-ui-v1.7.9
k8s-ui-v1.8.0
k8s-ui-v1.8.1
k8s-ui-v1.8.10
k8s-ui-v1.8.11
k8s-ui-v1.8.12
k8s-ui-v1.8.13
k8s-ui-v1.8.14
k8s-ui-v1.8.15
k8s-ui-v1.8.2
k8s-ui-v1.8.3
k8s-ui-v1.8.4
k8s-ui-v1.8.5
k8s-ui-v1.8.6
k8s-ui-v1.8.7
k8s-ui-v1.8.8
k8s-ui-v1.8.9
k8s-ui-v1.9.0
k8s-ui-v1.9.1
pkg/v1.*
pkg/v1.0.7
pkg/v1.1.0
pkg/v1.1.1
pkg/v1.1.2
pkg/v1.1.3
pkg/v1.10.0
pkg/v1.10.1
pkg/v1.10.2
pkg/v1.11.0
pkg/v1.12.0
pkg/v1.12.1
pkg/v1.2.0
pkg/v1.3.0
pkg/v1.3.1
pkg/v1.4.0
pkg/v1.4.1
pkg/v1.4.2
pkg/v1.4.3
pkg/v1.5.0
pkg/v1.5.1
pkg/v1.5.2
pkg/v1.5.3
pkg/v1.5.4
pkg/v1.5.5
pkg/v1.5.6
pkg/v1.5.7
pkg/v1.6.0
pkg/v1.7.0
pkg/v1.7.1
pkg/v1.7.2
pkg/v1.7.3
pkg/v1.7.4
pkg/v1.7.5
pkg/v1.7.6
pkg/v1.7.7
pkg/v1.7.8
pkg/v1.7.9
pkg/v1.8.0
pkg/v1.8.1
pkg/v1.8.2
pkg/v1.8.3
pkg/v1.8.4
pkg/v1.8.5
pkg/v1.8.6
pkg/v1.8.7
pkg/v1.8.8
pkg/v1.8.9
pkg/v1.9.0
radar-app-v0.*
radar-app-v0.1.0
radar-app-v0.1.1
radar-app-v0.1.2
radar-app-v0.1.3
radar-app-v0.1.5
radar-app-v0.1.6
radar-app-v0.1.8
radar-app-v0.1.9
radar-app-v0.2.0
radar-app-v0.2.1
radar-app-v0.2.2
radar-app-v1.*
radar-app-v1.0.0
radar-app-v1.0.1
radar-app-v1.1.0
radar-app-v1.1.1
radar-app-v1.1.2
radar-app-v1.10.0
radar-app-v1.11.0
radar-app-v1.12.0
radar-app-v1.12.1
radar-app-v1.12.2
radar-app-v1.2.0
radar-app-v1.2.1
radar-app-v1.2.2
radar-app-v1.2.3
radar-app-v1.3.0
radar-app-v1.3.1
radar-app-v1.3.2
radar-app-v1.3.3
radar-app-v1.3.4
radar-app-v1.3.5
radar-app-v1.4.0
radar-app-v1.4.1
radar-app-v1.4.2
radar-app-v1.5.0
radar-app-v1.6.0
radar-app-v1.6.1
radar-app-v1.6.2
radar-app-v1.7.0
radar-app-v1.8.0
radar-app-v1.8.1
radar-app-v1.8.10
radar-app-v1.8.11
radar-app-v1.8.12
radar-app-v1.8.13
radar-app-v1.8.2
radar-app-v1.8.3
radar-app-v1.8.4
radar-app-v1.8.5
radar-app-v1.8.6
radar-app-v1.8.7
radar-app-v1.8.8
radar-app-v1.8.9
radar-app-v1.9.0
radar-app-v1.9.1
radar-app-v1.9.2
radar-app-v1.9.3
radar-app-v1.9.4
radar-app-v1.9.5
radar-app-v1.9.6
radar-app-v1.9.7
v0.*
v0.2.0
v0.2.1
v0.2.2
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.6.0
v0.6.1
v0.6.10
v0.6.11
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.6.8
v0.6.9
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.8.0
v0.8.1
v0.8.2
v0.9.1
v0.9.10
v0.9.11
v0.9.12
v0.9.14
v0.9.15
v0.9.16
v0.9.17
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9
v1.*
v1.0.0
v1.0.1
v1.0.3
v1.0.4-rc1
v1.0.5
v1.0.6
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.10.0
v1.11.0
v1.12.0
v1.12.1
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.5.0
v1.5.1
v1.5.10
v1.5.11
v1.5.12
v1.5.13
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.5.9
v1.6.0
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.9.0
v1.9.1
v1.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82026.json"