Skyhook Radar CVE-2026-82026

Exploitation requires network reachability to the Radar host's /api/local-terminal WebSocket endpoint while Radar is running; no RBAC/role check is enforced, and the description indicates it succeeds even when the --disable-local-terminal flag is set, because the code trusts only a runtime-mode check. The principal LIMITING factors are deployment-driven: Radar is a local-first developer tool (kubectl-radar / desktop app) that is typically run on an individual workstation and likely binds the endpoint to localhost, so exploitation generally requires the attacker to already have local/same-host access or for the operator to have deliberately exposed the port to the network. No user interaction is needed, and per the description authentication is not reliably required despite the vendor's PR:L marking.

This is a CWE-862 missing-authorization flaw that yields full remote code execution on the Radar host, so the technical impact is severe (vendor CVSS 4.0 8.7 with VC:H/VI:H/VA:H). The vendor vector states AV:N/AC:L/PR:L/UI:N, indicating a low-complexity network attack requiring only low privileges. However, there is a notable internal conflict: the description explicitly says 'authenticated OR unauthenticated attackers' can exploit it because the endpoint relies only on a runtime-mode check instead of role-based access control, which argues for PR:N (truly unauthenticated) rather than the vendor's PR:L - verify authentication requirements with the vendor/VulnCheck advisory. No EPSS score, SSVC decision, or KEV status was provided in the input, and no public exploit is referenced, so exploitation probability cannot be quantified from the data. Mitigating the raw severity is the product's nature: Radar is a local-first, no-account Kubernetes visibility tool typically run on a developer workstation, so the /api/local-terminal WebSocket is likely bound to localhost unless deliberately exposed - meaning real-world network reach may be far narrower than AV:N suggests. Net assessment: high technical severity and trivially exploitable once reachable, but likely limited blast radius due to niche deployment and probable loopback binding; prioritize patching for any environment where Radar is network-exposed.

An attacker who can reach the Radar host's /api/local-terminal WebSocket endpoint connects to it and, because the endpoint enforces only a runtime-mode check rather than RBAC, is granted an interactive privileged shell. The shell runs /bin/bash -l with Radar's own kubeconfig and process credentials injected, giving the attacker code execution as Radar and a pivot into the Kubernetes cluster - and this works even when the --disable-local-terminal flag is set. No public exploit code is referenced in the provided data.