What is CVE-2026-83603?

CVE-2026-83603 is a high-severity vulnerability in Netdata, classified under External Control of File Name or Path. CVSS score: 8.4/10. Published 2026-09-22.

How severe is CVE-2026-83603?

High severity. CVSS v3 base score is 8.4 out of 10.

Deserialization in Netdata

CVE-2026-83603

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The account can direct root fail2ban-client to a malicious UNIX socket, and fail2ban/client/csocket.py CSocket.receive() passes the returned data to pickle.loads(), allowing attacker-controlled code to execute as root on systems with fail2ban-client installed. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.

Published 2026-09-22 · last modified 2026-09-22.

CVSS v3 metric

CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Netdata — versions < 2.10.4

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-83603?: CVE-2026-83603 is a high-severity vulnerability in Netdata, classified under External Control of File Name or Path. CVSS score: 8.4/10. Published 2026-09-22.
How severe is CVE-2026-83603?: High severity. CVSS v3 base score is 8.4 out of 10.