Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-83603Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE

High 8.4

In plain English

A high-severity unsafe deserialization in netdata from netdata. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.3%top 74.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The account can direct root fail2ban-client to a malicious UNIX socket, and fail2ban/client/csocket.py CSocket.receive() passes the returned data to pickle.loads(), allowing attacker-controlled code to execute as root on systems with fail2ban-client installed. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	netdata	no fix listed	DEBIAN-CVE-2026-83603
Ubuntu:24.04:LTS	netdata	no fix listed	UBUNTU-CVE-2026-83603

Affected products (as reported)

Vendor	Product	Versions
netdata	netdata	< 2.10.4

Weakness: CWE-73, CWE-502 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/netdata/netdata/security/advisories/GHSA-qwh9-pq27-993w x_refsource_CONFIRM
https://github.com/netdata/netdata/pull/22745 x_refsource_MISC
https://github.com/netdata/netdata/commit/9bced8d46464bd0fe01b0b5f8c63c4ac24e9b060 x_refsource_MISC
https://github.com/netdata/netdata/releases/tag/v2.10.4 x_refsource_MISC