CVE-2026-83602

Name of the Vulnerable Software and Affected Versions Netdata versions 2.0.0 through 2.10.x

Description An issue exists where the '/api/v3/settings' endpoint is registered with permissions that allow unauthenticated PUT requests to bypass IP restrictions configured by the operator. A network-reachable attacker can use this to persist controlled JSON data in the {varlib}/settings/default.json file and manipulate its version counter. Furthermore, repeated writes of nearly 20 MiB can be used to consume disk space, although the affected file does not control security policy or data collection.

Recommendations Update to version 2.11.0.