CVE-2026-82026
Description
A flaw was found in radar. A remote attacker could achieve arbitrary code execution due to missing authorization in the local terminal endpoint (/api/local-terminal). By connecting to this endpoint without proper access control checks, an attacker can spawn an interactive shell on the host system and execute arbitrary commands with the privileges of the application.
Statement
This vulnerability is rated as Important because remote users with network access to the management service can establish an interactive shell on the underlying host, resulting in complete compromise of the application environment. Although the blast radius includes arbitrary command execution with application privileges, exploitation is bounded by the prerequisite of direct network connectivity to the WebSocket interface. Radar is not distributed or supported in Red Hat enterprise product offerings.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
