Command Injection Vulnerability in Netdata By Vendor

CVE-2026-83603

What is CVE-2026-83603?

A command injection vulnerability has been discovered in Netdata, an open-source observability tool. Prior to version 2.10.4, the ndsudo helper command accepts a caller-controlled --socket_path from the low-privileged netdata service account. This flaw allows the account to redirect the root fail2ban-client to a malicious UNIX socket. Consequently, the fail2ban/client/csocket.py CSocket.receive() function processes this data using the pickle.loads() method, which can lead to the execution of attacker-controlled code with root privileges on systems running the affected versions of Netdata. This issue has been addressed in version 2.10.4 and the nightly build 2.10.0-782-nightly.

References