CVE-2026-82026 skyhook-io CVE debrief

Who should care

Radar administrators and users, security teams responsible for monitoring and patching Radar instances, and organizations using Radar for critical infrastructure. These stakeholders should prioritize patching, restrict access to the vulnerable endpoint, and monitor for suspicious activity to mitigate potential impacts.

Why it matters

CVE-2026-82026 is a high-severity vulnerability in Radar that allows attackers to execute remote code with elevated privileges. Defenders should prioritize patching to version 1.12.2 or later, restrict access to the /api/local-terminal endpoint, and monitor for suspicious activity. The vulnerability's impact requires verification from official sources, and evidence is limited to CVE and source item details.

• Remote code execution with elevated privileges.
• Potential for lateral movement within the network.
• Need for immediate patching or mitigation.
• Verification of Radar version and configuration.

Technical summary

The Radar application before version 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal). This vulnerability allows attackers to spawn a privileged shell by relying on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.

Defensive priority

High

Recommended defensive actions

• Review and apply the fixed release (version 1.12.2) for Radar.
• Restrict access to the /api/local-terminal endpoint.
• Monitor for suspicious activity on the Radar host.
• Verify the --disable-local-terminal flag is set as intended.
• Perform vulnerability scanning to identify exposed Radar instances.
• Implement additional logging and monitoring for the Radar host.
• Review and update incident response plans to address potential exploitation.

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in Radar before 1.12.2. The vulnerability allows authenticated or unauthenticated attackers to spawn a privileged shell by connecting to the /api/local-terminal endpoint.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.