Radar operating under versions prior to 1.12.2 has a missing authorization flaw in the /api/local-terminal WebSocket endpoint. The endpoint performs only a runtime‑mode check rather than enforcing role‑based access control, so both authenticated and unauthenticated attackers can connect. Once connected, an attacker can spawn a privileged /bin/bash shell on the Radar host that inherits Radar’s kubeconfig and process credentials, giving the attacker full execution authority on the host system. This leads to remote code execution using Radar’s own privileges.

All Skyhook‑IO Radar deployments running a version earlier than 1.12.2 are affected. This includes the 1.12.1 release and any previous builds; the vulnerability is absent in 1.12.2 and later.

The flaw receives a CVSS score of 8.7, indicating a high severity remote code execution capability. Its EPSS score is reported as less than 1%, showing a very low probability of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be network‑based, requiring only access to the Radar service’s WebSocket endpoint; authentication is not needed. Thus while the probability of exploitation is low, an attacker gaining access could obtain full control of the host and its Kubernetes resources.