Log in Start free

Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-83598Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair

High 7.8

In plain English

A high-severity privilege mismanagement in netdata from netdata. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 95.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 from the low-privileged user who initiated repair. Commands placed in that profile before repair therefore execute with SYSTEM privileges. This vulnerability is fixed in 2.10.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12netdatano fix listedDEBIAN-CVE-2026-83598
Ubuntu:24.04:LTSnetdatano fix listedUBUNTU-CVE-2026-83598

Affected products (as reported)

VendorProductVersions
netdata netdata >= 2.0.0, < 2.10.4

Weakness: CWE-269, CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References