Authorization Bypass in Radar handleLocalTerminal Endpoint

Radar versions prior to 1.12.2 contain a critical missing authorization vulnerability within the handleLocalTerminal WebSocket endpoint, located at /api/local-terminal. The application incorrectly relies on a runtime-mode check instead of robust role-based access control (RBAC), allowing authenticated or unauthenticated attackers to interface with the endpoint. This vulnerability enables the execution of /bin/bash -l on the host running the Radar instance. Notably, the vulnerability remains exploitable even when the --disable-local-terminal configuration flag is enabled. An attacker successfully leveraging this flaw gains remote code execution with the privileges of the Radar process, including access to injected kubeconfig and process credentials.

Impact

Successful exploitation results in full remote code execution on the host running Radar, granting the attacker the same permissions as the application. This potentially exposes Kubernetes cluster credentials and sensitive environment variables stored within the Radar process context, facilitating lateral movement within the cluster or cloud environment.

Recommendation

• Upgrade all Radar instances to version 1.12.2 or later to remediate CVE-2026-82026.
• Audit web server logs for POST or WebSocket upgrade requests directed at the /api/local-terminal URI from unauthorized source IPs.
• Implement network-level egress filtering for pods or nodes hosting Radar to prevent unauthorized use of the retrieved kubeconfig credentials if exploitation occurs.