Netdata is vulnerable to improper authentication

CVE-2023-22497

What is CVE-2023-22497?

This vulnerability in Netdata, an open-source solution for real-time infrastructure monitoring, arises from the way MACHINE GUIDs are handled within the streaming feature. When a Netdata Agent is configured in streaming mode, it acts as a parent for child agents, potentially exposing sensitive data if not properly secured. An attacker with access to a parent agent can exploit a valid MACHINE GUID as an unauthorized API key, compromising the security of all child agents. Users are advised to disable streaming by default, limit access to trusted connections, and upgrade to patched versions to mitigate risks.

References