CVE-2026-83597: Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution
Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or hijack those visible process windows to execute arbitrary commands with SYSTEM privileges. This issue is fixed in stable version 2.10.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netdata Windows Agentto a version that resolves this vulnerability.Fixed in 2.10.4
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged local user on a Windows system with an affected Netdata Windows Agent installation can exploit it. The attack requires the user to trigger MSI repair and interact with or hijack visible elevated process windows.
Are default installations affected?
The affected behavior is in the Netdata Windows Agent MSI repair process. Any installation running a version from 2.0.0 through 2.10.4 should be assessed for exposure when local users can initiate repair.
What is the impact of successful exploitation?
An attacker can execute arbitrary commands with SYSTEM privileges. This can result in full compromise of the affected Windows host.
What should be done if patching cannot happen immediately?
Restrict low-privileged local users from initiating MSI repair on affected systems, since exploitation depends on triggering the repair workflow and accessing its interactive elevated windows.
How can administrators remediate the issue?
Update the Netdata Windows Agent to the fixed stable version 2.10.4.