{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aradarradar/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:radar:radar:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-82026"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Radar (\u003c 1.12.2)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-82026","remote-code-execution","authorization-bypass"],"_cs_type":"advisory","_cs_vendors":["Radar"],"content_html":"\u003cp\u003eRadar versions prior to 1.12.2 contain a critical missing authorization vulnerability within the handleLocalTerminal WebSocket endpoint, located at /api/local-terminal. The application incorrectly relies on a runtime-mode check instead of robust role-based access control (RBAC), allowing authenticated or unauthenticated attackers to interface with the endpoint. This vulnerability enables the execution of /bin/bash -l on the host running the Radar instance. Notably, the vulnerability remains exploitable even when the --disable-local-terminal configuration flag is enabled. An attacker successfully leveraging this flaw gains remote code execution with the privileges of the Radar process, including access to injected kubeconfig and process credentials.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution on the host running Radar, granting the attacker the same permissions as the application. This potentially exposes Kubernetes cluster credentials and sensitive environment variables stored within the Radar process context, facilitating lateral movement within the cluster or cloud environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Radar instances to version 1.12.2 or later to remediate CVE-2026-82026.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for POST or WebSocket upgrade requests directed at the /api/local-terminal URI from unauthorized source IPs.\u003c/li\u003e\n\u003cli\u003eImplement network-level egress filtering for pods or nodes hosting Radar to prevent unauthorized use of the retrieved kubeconfig credentials if exploitation occurs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T14:23:48Z","date_published":"2026-10-14T14:23:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-radar-auth-bypass/","summary":"Radar versions prior to 1.12.2 contain a missing authorization vulnerability allowing attackers to execute commands via the /api/local-terminal WebSocket endpoint.","title":"Authorization Bypass in Radar handleLocalTerminal Endpoint","url":"https://feed.craftedsignal.io/briefs/2026-10-radar-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:radar:radar:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}