CVE-2026-83602: Netdata Auth Bypass Vulnerability

CVE-2026-83602 Overview

Netdata is an open source observability tool used for real-time system and application monitoring. CVE-2026-83602 is a broken access control vulnerability [CWE-284] affecting Netdata versions 2.0.0 through 2.10.x. The /api/v3/settings endpoint registers with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, bypassing the operator-configured allow dashboard from IP restrictions. Unauthenticated network-reachable attackers can issue PUT requests to persist attacker-controlled JSON in {varlib}/settings/default.json and consume disk space through repeated near-20 MiB writes. The issue is fixed in version 2.11.0.

Critical Impact
Unauthenticated remote attackers can bypass IP allowlist restrictions to modify persistent settings state and exhaust disk space on the Netdata host.

Affected Products

Netdata 2.0.0 through 2.10.x
/api/v3/settings endpoint in src/web/api/v3/web_api_v3.c
api_v3_settings handler in src/web/api/v3/api_v3_settings.c

Discovery Timeline

2026-09-22 - CVE CVE-2026-83602 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-83602

Vulnerability Analysis

The vulnerability originates in Netdata's API endpoint registration table. The /api/v3/settings route was declared with the access control level HTTP_ACL_NOCHECK, which instructs the HTTP dispatcher to skip per-feature IP allowlist enforcement. Combined with HTTP_ACCESS_ANONYMOUS_DATA, the endpoint accepts unauthenticated requests from any network-reachable client.

A remote caller can issue a PUT request to /api/v3/settings and cause the handler to write attacker-controlled JSON to {varlib}/settings/default.json. The handler also honors a version counter within the payload, allowing an attacker to manipulate persisted state. Because writes can approach 20 MiB per request and can be repeated, an attacker can consume disk space on the host. The advisory notes the settings file does not control collection or security policy, which limits the direct integrity impact.

Root Cause

The root cause is an incorrect access control classification [CWE-284] in the API registration table. The settings endpoint was gated with HTTP_ACL_NOCHECK rather than HTTP_ACL_DASHBOARD, exempting it from the allow dashboard from IP restrictions that operators configure to fence off dashboard-scoped functionality.

Attack Vector

Exploitation requires only network reachability to the Netdata HTTP listener. No authentication, user interaction, or elevated privileges are needed. The attacker sends PUT /api/v3/settings requests containing arbitrary JSON payloads and optional version counter values.

     {
         .api = "settings",
         .hash = 0,
-        .acl = HTTP_ACL_NOCHECK,
+        // settings is a dashboard feature: gate it behind `allow dashboard from` like the rest
+        // of the dashboard, instead of HTTP_ACL_NOCHECK which bypassed the per-feature IP
+        // allowlists and exposed the anonymous state-modifying PUT remotely.
+        .acl = HTTP_ACL_DASHBOARD,
         .access = HTTP_ACCESS_ANONYMOUS_DATA,
         .callback = api_v3_settings,
         .allow_subpaths = 0

Source: GitHub Commit 0124f50

Detection Methods for CVE-2026-83602

Indicators of Compromise

Unexpected PUT requests to /api/v3/settings from IPs outside the configured allow dashboard from range.
Presence or recent modification of {varlib}/settings/default.json containing unfamiliar JSON content or an anomalous version counter.
Rapid growth of the {varlib}/settings/ directory or the Netdata data volume approaching disk capacity.

Detection Strategies

Parse Netdata HTTP access logs for PUT /api/v3/settings events and correlate against the operator-approved dashboard source ranges.
Alert on large request bodies (near 20 MiB) directed at the Netdata API listener.
Monitor the integrity of {varlib}/settings/default.json using file integrity monitoring and flag unauthorized changes.

Monitoring Recommendations

Track disk utilization on Netdata hosts and alert on abnormal fill rates targeting the varlib volume.
Forward Netdata web server logs to a centralized log platform for retention and query.
Baseline normal API traffic volume per source IP and alert on outliers targeting /api/v3/settings.

How to Mitigate CVE-2026-83602

Immediate Actions Required

Upgrade all Netdata instances to version 2.11.0 or later, which replaces HTTP_ACL_NOCHECK with HTTP_ACL_DASHBOARD on the settings endpoint.
Restrict network exposure of the Netdata HTTP listener to trusted management networks using firewall or reverse proxy rules.
Audit {varlib}/settings/default.json on all Netdata hosts and restore known-good content if tampering is suspected.

Patch Information

The fix is included in Netdata release 2.11.0. The patch is tracked in GitHub Pull Request #22896 and applied in commit 0124f50. Additional context is provided in the GitHub Security Advisory GHSA-8hjg-8hcf-fmwp and the Netdata v2.11.0 release notes.

Workarounds

Place the Netdata dashboard behind a reverse proxy that enforces authentication and IP allowlisting for /api/v3/settings.
Block inbound PUT requests to /api/v3/settings at the network edge until upgrade is completed.
Bind the Netdata listener to a management-only interface rather than exposing it on public networks.

bash

# Example nginx snippet blocking PUT to the vulnerable endpoint until patched
location = /api/v3/settings {
    limit_except GET {
        deny all;
    }
    proxy_pass http://127.0.0.1:19999;
}