CVE-2026-83602
6.5 MEDIUMpublic exploit availablePublished 2026-09-22 · Updated 2026-09-28
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-284
Public exploit & PoC references
- https://github.com/netdata/netdata/commit/0124f50bbcf36c23e798e2b76f021f5032ec93d4
- https://github.com/netdata/netdata/pull/22896
- https://github.com/netdata/netdata/releases/tag/v2.11.0
- https://github.com/netdata/netdata/security/advisories/GHSA-8hjg-8hcf-fmwp
- https://github.com/netdata/netdata/security/advisories/GHSA-8hjg-8hcf-fmwp
All references
- https://github.com/netdata/netdata/commit/0124f50bbcf36c23e798e2b76f021f5032ec93d4
- https://github.com/netdata/netdata/pull/22896
- https://github.com/netdata/netdata/releases/tag/v2.11.0
- https://github.com/netdata/netdata/security/advisories/GHSA-8hjg-8hcf-fmwp
- https://github.com/netdata/netdata/security/advisories/GHSA-8hjg-8hcf-fmwp
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2025-70962PoC
- MEDIUMCVE-2026-100621PoC
- MEDIUMCVE-2026-100883PoC
- MEDIUMCVE-2026-100906PoC
- MEDIUMCVE-2026-100907PoC
- HIGHCVE-2026-101053PoC
- MEDIUMCVE-2026-101054PoC
- MEDIUMCVE-2026-101055PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.