CVE-2026-83602 in Netdata
Summary
by MITRE • 09/22/2026
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified within Netdata versions ranging from 2.0.0 through 2.11.0 represents a critical authentication bypass and resource exhaustion flaw inherent to the configuration management subsystem of this open-source observability platform. The core technical deficiency lies in how the application registers specific API endpoints for handling system settings. Specifically, the endpoint /api/v3/settings was configured with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA flags during initialization in src/web/api/v3/web_api_v3.c. These configuration directives effectively disable access control checks and permit anonymous data operations on this particular route. Consequently, any network-reachable client can interact with the settings management interface without providing valid credentials or session tokens, fundamentally undermining the intended security model of the application which relies on operator-defined IP restrictions to limit administrative access.
The operational impact of this authentication bypass is multifaceted, involving both data integrity risks and availability threats. An attacker exploiting this flaw can send unauthenticated PUT requests to the affected endpoint, thereby persisting arbitrary JSON content into the default settings file located at {varlib}/settings/default.json. While the vulnerability description notes that these manipulated files do not directly control collection mechanisms or core security policies in a way that would allow for remote code execution or immediate privilege escalation, they can still be used to disrupt normal operations by injecting malformed configuration data. More critically, the vulnerability enables a severe denial-of-service scenario through disk space exhaustion. The API allows for repeated writes of nearly 20 MiB per request without adequate size validation or rate limiting mechanisms in place during this specific time window. An attacker can leverage this capability to rapidly consume available storage on the host system running Netdata, potentially causing service degradation or complete failure if critical logs or other data cannot be written due to lack of disk space.
This vulnerability aligns with several established industry standards for software security flaws. It is primarily categorized under CWE-287, which describes Improper Authentication, as the application fails to correctly verify identity before granting access to sensitive configuration endpoints. Additionally, the ability to manipulate system state via unauthenticated requests relates to CWE-613, Insufficient Session Expiration, in a broader sense of session and request validation failures. The exploitation technique involving repeated large writes to exhaust resources is characteristic of CWE-400, Uncontrolled Resource Consumption, which often leads to denial-of-service conditions. From an offensive security perspective, this vulnerability maps to the MITRE ATT&CK framework techniques associated with Initial Access via unauthenticated endpoints and Impact through resource exhaustion or data manipulation. The lack of input validation on file size further exacerbates the risk, allowing for efficient abuse of system resources without requiring complex payload construction beyond standard HTTP PUT methods.
The remediation strategy implemented in version 2.11.0 addresses these deficiencies by correcting the access control configuration for the /api/v3/settings endpoint. The fix ensures that proper authentication checks are enforced, preventing anonymous users from modifying critical settings files. To mitigate this vulnerability in affected systems prior to upgrading, operators should ensure that Netdata is not exposed directly to untrusted networks or firewalled such that only authorized IP addresses can reach the web interface. Implementing network-level access control lists serves as an effective compensating control given the application's failure to enforce authentication at the API layer. Furthermore, monitoring disk usage and implementing rate limiting on administrative endpoints can help detect and prevent abuse attempts while patches are being deployed. Organizations relying on Netdata for infrastructure observability must prioritize upgrading to version 2.11.0 or later to restore the integrity of their access control policies and protect against potential denial-of-service attacks stemming from this configuration flaw.