CVE-2026-83602
MediumCVSS 6.5Summary
In Netdata from 2.0.0 until 2.11.0, the /api/v3/settings endpoint is registered with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, allowing unauthenticated PUT requests to bypass operator-configured IP allow restrictions. An attacker can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space.
Risk Assessment
An unauthenticated network-reachable attacker can modify the settings file and exhaust disk space, potentially causing service disruption or host instability. The file does not control collection or security policy, so configuration impact is limited.
Recommendation
Upgrade Netdata to version 2.11.0 or later. Until then, restrict network access to the /api/v3/settings endpoint via firewall or reverse proxy.
Other vulnerabilities in Netdata
See all- CVE-2026-83603High
Netdata prior to 2.10.4 contains a vulnerability in the setuid-root ndsudo helper command fail2ban-client-status-socket which accepts a caller-controlled --socket_path from the low-privileged netdata service account, allowing attacker-controlled code to execute as root on systems with fail2ban-client installed.
- CVE-2026-83601Medium
In Netdata prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rrddim_put_to_slot without an upper bound. prd_array_create can then wrap the size_t allocation calculation while retaining the original large array size, causing the initialization loop to write beyond the undersized heap allocation and crash the parent agent.
- CVE-2026-83600Medium
In Netdata prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent.
- CVE-2026-83599High
Netdata prior to 2.11.0 contains a vulnerability in the unauthenticated WebSocket server that allows an attacker to send small highly compressed frames, leading to large server-side allocations and causing memory exhaustion and termination of monitoring.
- CVE-2026-83598High
Netdata from 2.0.0 to 2.10.4 contains a vulnerability during MSI repair where powershell.exe runs as SYSTEM without -NoProfile and loads the user's PowerShell profile, allowing commands placed in that profile to execute with SYSTEM privileges.
- CVE-2025-71385Medium
Reflected XSS vulnerability in Netdata before 2.3.1 in the api/v2/ilove.svg and api/v3/ilove.svg endpoints. An attacker can inject malicious JavaScript via the love parameter, which is reflected in the SVG response without proper encoding. The endpoints are accessible without authentication, allowing remote script execution in the victim's browser.
Original NVD description (English source)
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.