CVE-2026-83602
Netdata is an open source observability tool.
Impact
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/netdata/netdata/commit/0124f50bbcf36c23e798e2b76f021f5032ec93d4
- https://github.com/netdata/netdata/pull/22896
- https://github.com/netdata/netdata/releases/tag/v2.11.0
- https://github.com/netdata/netdata/security/advisories/GHSA-8hjg-8hcf-fmwp
- https://github.com/netdata/netdata/security/advisories/GHSA-8hjg-8hcf-fmwp