CVE-2026-83603: Netdata Observability Tool RCE Vulnerability

CVE-2026-83603 Overview

Netdata is an open source observability tool used for real-time system and application monitoring. Prior to version 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path argument from the low-privileged netdata service account. An attacker with control of the netdata account can direct the root fail2ban-client to a malicious UNIX socket. The CSocket.receive() method in fail2ban/client/csocket.py then passes attacker-controlled data to pickle.loads(), resulting in code execution as root [CWE-73].

Critical Impact
A local attacker with access to the netdata service account can achieve arbitrary code execution as root on hosts where fail2ban-client is installed alongside vulnerable Netdata builds.

Affected Products

Netdata versions prior to 2.10.4
Netdata nightly builds prior to 2.10.0-782-nightly
Systems with fail2ban-client installed alongside vulnerable Netdata

Discovery Timeline

2026-09-22 - CVE-2026-83603 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-83603

Vulnerability Analysis

The flaw resides in the ndsudo setuid-root helper shipped with Netdata. ndsudo exposes a fail2ban-client-status-socket subcommand designed to query fail2ban jail status through the fail2ban-client binary. Before the fix, this subcommand honored a --socket_path parameter supplied by the low-privileged netdata service user. Because ndsudo executes as root, it invokes fail2ban-client with root privileges and passes the attacker-controlled socket path to it.

The fail2ban-client Python code connects to the specified UNIX socket and calls pickle.loads() on data returned by the peer. Python's pickle module executes arbitrary object constructors during deserialization. An attacker who binds a rogue UNIX socket at a path they control can return a crafted pickle payload that runs arbitrary code in the root-privileged client process.

Root Cause

The root cause is external control of a file name or path [CWE-73] combined with insecure deserialization in the downstream client. ndsudo treats the socket path as a benign configuration input rather than a security-sensitive argument that must be constrained to trusted, root-owned paths.

Attack Vector

Exploitation requires local access as the netdata service account. The attacker creates a UNIX socket at an arbitrary filesystem path, then invokes the setuid ndsudo helper with fail2ban-client-status-socket --socket_path=/tmp/attacker.sock. The root fail2ban-client connects to that socket, receives a malicious pickle payload, and executes attacker-supplied code as root.

#define MAX_SEARCH 3
#define MAX_PARAMETERS 128
#define ERROR_BUFFER_SIZE 1024
#define FAIL2BAN_SOCKET_PATH_IN_DOCKER "/host/var/run/fail2ban/fail2ban.sock"

struct command {
    const char *name;
// Source: https://github.com/netdata/netdata/commit/9bced8d46464bd0fe01b0b5f8c63c4ac24e9b060

The patch hardcodes the fail2ban socket path inside ndsudo itself and removes the caller-supplied path from the Go collector:

var errJailNotExist = errors.New("jail not exist")

// removed: const socketPathInDocker = "/host/var/run/fail2ban/fail2ban.sock"

type fail2banClientCli interface {
    status() ([]byte, error)
    jailStatus(s string) ([]byte, error)
// Source: https://github.com/netdata/netdata/commit/9bced8d46464bd0fe01b0b5f8c63c4ac24e9b060

Detection Methods for CVE-2026-83603

Indicators of Compromise

Execution of ndsudo with a fail2ban-client-status-socket subcommand and a non-standard --socket_path value
UNIX socket files created under user-writable directories such as /tmp, /var/tmp, or the netdata home directory
fail2ban-client processes spawned by ndsudo connecting to sockets outside /var/run/fail2ban/
Unexpected root-owned child processes spawned from fail2ban-client (shells, network utilities, package managers)

Detection Strategies

Monitor process execution telemetry for ndsudo invocations by the netdata service account, correlating the command line for suspicious --socket_path arguments
Alert on any root-privileged process descending from the netdata user that is not on an allowlist
Inspect installed Netdata versions across the fleet and flag hosts below 2.10.4 where fail2ban-client is present

Monitoring Recommendations

Enable Linux auditd rules for execve on the ndsudo binary and forward events to a central log store
Track UNIX socket creation events using eBPF or auditd, focusing on the netdata UID
Baseline expected parent-child relationships for fail2ban-client and alert on deviations

How to Mitigate CVE-2026-83603

Immediate Actions Required

Upgrade Netdata to version 2.10.4 or nightly 2.10.0-782-nightly or later on every host running the agent
Audit hosts for the presence of both Netdata and fail2ban-client, prioritizing those systems for patching
Review recent process telemetry from the netdata account for prior invocations of ndsudo fail2ban-client-status-socket

Patch Information

The vendor fix moves the fail2ban socket path into ndsudo as a compiled-in constant, removing the caller-controlled --socket_path argument. See the GitHub Security Advisory GHSA-qwh9-pq27-993w, the remediation commit, and the Netdata Release v2.10.4 notes. Additional discussion is available in Pull Request #22745.

Workarounds

Remove the setuid bit from the ndsudo binary if the fail2ban collector is not required in your deployment
Uninstall fail2ban-client on hosts that do not use fail2ban jail monitoring through Netdata
Restrict interactive and remote access to the netdata service account to prevent local exploitation

bash

# Verify the installed Netdata version and remediation status
netdata -v

# Remove the setuid bit from ndsudo as a temporary workaround
sudo chmod u-s /usr/libexec/netdata/plugins.d/ndsudo

# Confirm fail2ban-client presence on the host
command -v fail2ban-client && echo "fail2ban-client present - prioritize patching"