Missing Authorization Vulnerability in Radar by Skyhook

CVE-2026-82026

What is CVE-2026-82026?

The Radar product by Skyhook suffers from a missing authorization vulnerability within its WebSocket endpoint for local terminal access. This flaw permits both authenticated and unauthenticated attackers to execute commands with elevated privileges by exploiting a runtime-mode check rather than proper role-based access control. This oversight allows attackers to access the local terminal API and execute '/bin/bash -l', thereby gaining remote code execution capabilities with Radar's privileges. Even the protective flag '--disable-local-terminal' fails to prevent this exploit, posing a significant risk to systems running versions prior to 1.12.2.

References