CVE-2026-83602

Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK

6.5 Medium

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

0.36%Down 0.2 points since Sep 23, 2026

What each source reports

CVE List Score used 6.5

Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK

Record: CVE-2026-83602
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2026-84562 6.5

Record: EUVD-2026-84562
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

NVD 6.5

Record: CVE-2026-83602
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-284
Updated: 2026-11-02

OSV 6.5

Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK

Record: CVE-2026-83602
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-284
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-83602 6.5

Record: DEBIAN-CVE-2026-83602
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-83602 6.5

Record: UBUNTU-CVE-2026-83602
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

Affected products

netdata

Affected packages

Affected packages
Package	Affected	Fixed
`netdata` Debian:12	All versions, plus listed versions 1.37.1-21.38.0-11.38.1-11.39.0-11.39.1-1 Show 26 moreShow less 1.39.1-21.40.0-11.40.0-21.40.1-11.41.0-11.42.0-11.42.1-11.42.2-11.42.3-11.42.4-11.43.0-11.43.1-11.43.2-11.44.3-11.44.3-21.46.3-11.46.3-21.47.0-11.47.1-11.47.2-11.47.5-12.0.3+dfsg-12.0.3+dfsg-22.0.3+dfsg-32.0.3+dfsg-42.0.3+dfsg-5	None known
`netdata` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1.7.0+dfsg-11.8.0+dfsg-11.9.0+dfsg-11.9.0+dfsg-1ubuntu0.1~esm1	None known
`netdata` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 1.16.1-21.19.0-3ubuntu11.19.0-3ubuntu1+esm1	None known
`netdata` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1.29.3-41.31.0-41.33.1-1ubuntu11.33.1-1ubuntu1+esm1	None known
`netdata` Ubuntu:24.04:LTS	All versions, plus listed versions 1.42.1-11.43.1-11.43.2-11.43.2-1build11.43.2-1build2	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-83602 is a medium vulnerability (CVSS 6.5) in Netdata, published September 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. No source names a fixed version.