CVE-2026-83603
Received Received - Intake

Code Execution via Malicious UNIX Socket in Netdata

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The account can direct root fail2ban-client to a malicious UNIX socket, and fail2ban/client/csocket.py CSocket.receive() passes the returned data to pickle.loads(), allowing attacker-controlled code to execute as root on systems with fail2ban-client installed. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-83603
EUVD
EUVD-2026-84564

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
netdata netdata to 2.10.4 (inc)
netdata netdata to 2.10.4 (exc)
fail2ban fail2ban *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Netdata (CVE-2026-83603) allows a low-privileged netdata service account to escalate privileges to root. The ndsudo helper, which runs with root permissions, accepts a user-controlled --socket_path parameter for fail2ban-client commands. An attacker can direct fail2ban-client to a malicious UNIX socket, which then deserializes attacker-controlled data via pickle.loads(), executing arbitrary code as root.

Detection Guidance

Check if your Netdata version is below 2.10.4. Run 'netdata --version' to verify. Inspect ndsudo helper commands for fail2ban-client-status-socket usage. Look for unexpected socket path parameters in fail2ban-client calls.

Impact Analysis

If exploited, this vulnerability allows an attacker to gain full root access on systems running vulnerable Netdata versions with fail2ban-client installed. This could lead to complete system compromise, data theft, or further network attacks. The attack requires low complexity and no user interaction.

Compliance Impact

This vulnerability could lead to unauthorized root access, violating data protection requirements under GDPR and HIPAA. Unauthorized access may result in data breaches, non-compliance with security controls, and potential legal penalties due to compromised confidentiality and integrity of sensitive data.

Mitigation Strategies

Upgrade Netdata to version 2.10.4 or later. Remove vulnerable socket variants and hard-code socket paths in ndsudo. Validate parameters strictly and reject paths starting with hyphens. Ensure fail2ban-client is not accessible via ndsudo with user-controlled inputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart