Skip to content
OpenAdvisories

Vendor

netdata

11 known vulnerabilities.

netdata at a glance

Last 12 months
8
Critical · all time
0
Exploited · all time
0
Public exploit · all time
3
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 7 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202670
Aug 202600
Jul 202610
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

netdata 11
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • High 7.0
    CVE-2026-83597

    Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

    Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user wh…

    netdata netdata netdata netdata Debian Ubuntu
  • Medium 6.5
    CVE-2026-83600

    Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent

    Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The accepted slot drives…

    netdata netdata netdata netdata Debian Ubuntu
  • High 7.8
    CVE-2026-83598

    Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair

    Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 from the …

    netdata netdata netdata netdata Debian Ubuntu
  • High 8.4
    CVE-2026-83603 Public exploit

    Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE

    Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The …

    netdata netdata netdata netdata Debian Ubuntu
  • Medium 6.5
    CVE-2026-83601

    Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write

    Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rrddim_put_to_slot in src/plugins.d/pluginsd_internals.h without an upper bound. prd…

    netdata netdata netdata netdata Debian Ubuntu
  • Medium 6.5
    CVE-2026-83602

    Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK

    Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v…

    netdata netdata netdata netdata Debian Ubuntu
  • High 7.5
    CVE-2026-83599

    Netdata: WebSocket Decompression Bomb

    Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocket_client_decompress_message() to grow d…

    netdata netdata netdata netdata Debian Ubuntu
  • Medium 6.1
    CVE-2025-71385

    Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint

    Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type …

    netdata netdata netdata Ubuntu
  • High 8.8
    CVE-2024-32019 Public exploit

    ndsudo: local privilege escalation via untrusted search path

    Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned execut…

    netdata netdata
  • Medium 6.5
    CVE-2023-22497

    Netdata is vulnerable to improper authentication

    Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. It is generated when the agent first starts and it is saved to disk, so that it will persist across r…

    netdata netdata netdata netdata Debian Ubuntu
  • High 8.1
    CVE-2023-22496 Public exploit EPSS 36%

    Netdata vulnerable to command injection

    Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the functi…

    netdata netdata netdata Debian