CVE-2026-83602
Received Received - Intake

Unauthenticated PUT Request Bypass in Netdata

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-83602
EUVD
EUVD-2026-84562

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
netdata netdata From 2.0.0 (inc) to 2.11.0 (exc)
netdata netdata 2.11.0
netdata netdata to 2.10.4 (exc)
netdata netdata to 2.10.0-782-nightly (exc)
netdata netdata From 2.0.0 (inc) to 2.11.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-83602 is a vulnerability in Netdata versions 2.0.0 to 2.11.0 where the /api/v3/settings endpoint bypasses IP allowlist restrictions due to HTTP_ACL_NOCHECK. This allows unauthenticated remote attackers to perform PUT requests, overwrite settings with attacker-controlled JSON, manipulate version counters, and consume disk space via large payloads.

Detection Guidance

Check Netdata versions between 2.0.0 and 2.11.0. Inspect network traffic for PUT requests to /api/v3/settings. Look for large payloads (~20 MiB) or repeated writes to {varlib}/settings/default.json. Verify if HTTP_ACL_NOCHECK is used in src/web/api/web_api_v3.c.

Impact Analysis

An attacker could exploit this to overwrite Netdata settings persistently, consume disk space with large writes, and manipulate version counters. This may lead to service disruption or unauthorized changes, though it does not directly control data collection or security policies.

Mitigation Strategies

Upgrade Netdata to version 2.11.0 or later. Remove HTTP_ACL_NOCHECK from the settings endpoint and replace it with HTTP_ACL_DASHBOARD. Restrict PUT requests to authenticated users and audit all HTTP_ACL_NOCHECK registrations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart