CVE-2026-83602: Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netdatato a version that resolves this vulnerability.Fixed in 2.11.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Netdata versions from 2.0.0 until 2.11.0 are affected if a caller can reach the Netdata web API over the network. Configuring dashboard IP allowlist restrictions does not protect this endpoint in affected versions.
What does an attacker need to exploit this issue?
An attacker needs only network reachability to the affected Netdata API endpoint. No authentication, privileges, or user interaction are required.
What can exploitation change or disrupt?
An attacker can write attacker-controlled JSON to {varlib}/settings/default.json and manipulate its version counter. Repeated writes close to 20 MiB can consume disk space, but the settings file does not control collection or security policy.
What should be done if upgrading is not immediately possible?
Restrict network reachability to the Netdata web API so untrusted callers cannot access /api/v3/settings. Do not rely solely on the dashboard IP allowlist for this endpoint on affected versions.
How can I check for possible exploitation?
Inspect {varlib}/settings/default.json for unexpected content or version-counter changes, and investigate unusual disk consumption caused by repeated large writes. The affected request path is PUT /api/v3/settings.