CVE-2026-83598: Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair
Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repair. Commands placed in that profile before repair therefore execute with SYSTEM privileges. This vulnerability is fixed in 2.10.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netdata Agent Windowsto a version that resolves this vulnerability.Fixed in 2.10.4
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged local user who can initiate an MSI repair of an affected Netdata Windows Agent installation can exploit it. The attack requires local access; no user interaction is required once the repair is started.
What conditions are required for exploitation?
The affected agent must be between version 2.0.0 and 2.10.4, and the user must place commands in their %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 file before initiating MSI repair. During repair, PowerShell loads that profile while running as SYSTEM.
How can I tell whether a system is exposed?
Systems running Netdata Windows Agent versions from 2.0.0 through 2.10.4 are affected if users can initiate MSI repair. Review user PowerShell profile files, especially %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1, for unexpected commands.
What should be done if patching cannot happen immediately?
Prevent untrusted low-privileged users from initiating Netdata MSI repair and monitor or restrict modification of user PowerShell profile files. Upgrade to Netdata version 2.10.4 when possible.