What is CVE-2026-83602?

CVE-2026-83602 is a medium-severity vulnerability in Netdata, classified under Improper Access Control. CVSS score: 6.5/10. Published 2026-09-22.

How severe is CVE-2026-83602?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Netdata

CVE-2026-83602

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.

Published 2026-09-22.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Netdata — versions >= 2.0.0, < 2.11.0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

Frequently asked questions

What is CVE-2026-83602?: CVE-2026-83602 is a medium-severity vulnerability in Netdata, classified under Improper Access Control. CVSS score: 6.5/10. Published 2026-09-22.
How severe is CVE-2026-83602?: Medium severity. CVSS v3 base score is 6.5 out of 10.