CVE-2026-83602mediumCWE-284

CVE-2026-83602: falha de média gravidade em netdata

Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar netdata+ Monitorar netdata

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
netdata · netdata
CVEs relacionadas — netdata

No mesmo produto, das mais perigosas para as menos.

CVE-2023-22496HIGHNetdata vulnerable to command injection EPSS 36.2%CVE-2024-32019HIGHndsudo: local privilege escalation via untrusted search pathEPSS 1.2%CVE-2026-83599HIGHNetdata: WebSocket Decompression BombEPSS 0.7%CVE-2023-22497MEDIUMNetdata is vulnerable to improper authenticationEPSS 0.7%CVE-2026-83600MEDIUMNetdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agentEPSS 0.5%CVE-2025-71385MEDIUMNetdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg EndpointEPSS 0.4%