Read the docs
TI-2026-57703 Aliases CVE-2026-83603

Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE

Priority LOW 38CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The account can direct root fail2ban-client to a malicious UNIX socket, and fail2ban/client/csocket.py CSocket.receive() passes the returned data to pickle.loads(), allowing attacker-controlled code to execute as root on systems with fail2ban-client installed. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0032 25th percentileScored 2026-11-07
Fix Fixed netdata (netdata): 2.10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
netdatanetdatabefore 2.10.42.10.4Patch availableCNA
  • netdata Vendornetdata Affected before 2.10.4 Fixed in 2.10.4 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:*——netdata
  • cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:* Versions — — ·netdata

Remediation

  • Fix · CNA netdata (netdata) Fixed in 2.10.4

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-83603

References

Other 4

  • TI-2023-08744 Netdata vulnerable to command injection CVSS 3.1CRITICAL 9.8
  • TI-2024-21114 ndsudo: local privilege escalation via untrusted search path CVSS 3.1HIGH 8.8
  • TI-2023-08745 Netdata is vulnerable to improper authentication CVSS 3.1CRITICAL 9.1
  • TI-2026-57702 Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK CVSS 3.1MEDIUM 6.5
  • TI-2026-57701 Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write CVSS 3.1MEDIUM 6.5
  • TI-2026-57700 Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences