CVE-2026-83603: Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client to a malicious UNIX socket, and fail2ban/client/csocket.py CSocket.receive() passes the returned data to pickle.loads(), allowing attacker-controlled code to execute as root on systems with fail2ban-client installed. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netdatato a version that resolves this vulnerability.Fixed in 2.10.4
Event History
Frequently Asked Questions
Which systems are exposed to root compromise?
Systems running a Netdata version prior to 2.10.4 are exposed if fail2ban-client is installed. Exploitation requires access as the low-privileged netdata service account, which can invoke the setuid-root ndsudo helper.
What does an attacker need to exploit this issue?
The attacker needs local code execution or equivalent access as the netdata service account. They must be able to provide a malicious UNIX socket path to the fail2ban-client-status-socket helper command and return crafted data through that socket.
What version should be deployed to remediate the issue?
Upgrade Netdata to version 2.10.4 or later. The issue is also fixed in nightly build 2.10.0-782-nightly.
What can be done if an immediate Netdata upgrade is not possible?
The provided information identifies fail2ban-client installation as a condition for exploitation. Removing or otherwise ensuring fail2ban-client is unavailable reduces exposure until Netdata can be upgraded, but the documented remediation is upgrading Netdata.