Skyhook Radar: Missing authorization in local terminal WebSocket endpoint
Summary
Radar before 1.12.2 does not enforce authorization on the /api/local-terminal WebSocket endpoint and relies only on a runtime-mode check. An attacker who can reach Radar can open a shell on the Radar host as Radar's operating-system user, with Radar's kubeconfig and credentials. The shell is reachable even when --disable-local-terminal is set, which leads to remote code execution with Radar's privileges.
Affected
- Radar before 1.12.2 (skyhook-io radar, CNA: VulnCheck)
- Some sources report up to 1.12.1 as affected, which is consistent with this range.
Fixed in
- Fixed in v1.12.2 (pull requests #1534 and #1537).
- The vendor's desktop release v1.12.3 adds further restrictions; upgrade to v1.12.3 or later.
Workaround
- No vendor-published workaround found.
- Until patched, keep Radar off shared networks and the internet; use loopback or a VPN only.
- Limit the kubeconfig used by Radar to low privileges, as the shell inherits it.
Exploitation
- Exploited in the wild: no evidence found. CISA KEV not checked.
- Public proof of concept: none found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Upgrade Radar to v1.12.3 or later without delay.
- Check whether Radar is reachable from anything other than trusted admin workstations and restrict network access.
- Review the kubeconfig and privileges Radar runs with and reduce them to the minimum needed.
- Monitor for unexpected shell sessions or connections to /api/local-terminal on the Radar host.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Official CVE record / VulnCheck advisory www.vulncheck.com
- Radar release v1.12.2 github.com
- Pull Request #1534 github.com
- Pull Request #1537 github.com
- Radar desktop release v1.12.3 github.com
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:06.
Original description (NVD)
Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.