# CVE-2026-83602: Netdata API access control bypass in /api/v3/settings

Source: https://junglewise.ai/threats/cve-2026-83602-netdata-is-an-open-source-observability-tool-from-2-0-0-until-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-83602 · Severity: medium · CVSS 6.5 · Published 2026-09-22

Netdata, an open-source monitoring platform, exposes a settings configuration endpoint without proper authentication controls. An attacker on the network can send unauthenticated requests to modify stored settings and consume disk space by writing large files, bypassing IP-based access restrictions that administrators intended to enforce.

Technologies: [Netdata](https://junglewise.ai/threats/technologies/netdata). Vendors: [Netdata](https://junglewise.ai/threats/vendors/netdata).

## Quick answers

**Is CVE-2026-83602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83602 being exploited in the wild.

**How severe is CVE-2026-83602?** Medium severity, with a CVSS score of 6.5, published 22 September 2026.

**Which products and versions are affected?** Netdata 2.0.0 to 2.10.x.

**Is there a fix for CVE-2026-83602?** A patch was published on 2026-07-09: Fix merged to master via PR #22896, released in 2.11.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-83602 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-83602?** Check whether you run Netdata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /api/v3/settings endpoint in Netdata 2.0.0 through 2.10.x was registered with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, allowing unauthenticated PUT requests to bypass IP allowlists configured via the dashboard access policy. An attacker can persist arbitrary JSON to {varlib}/settings/default.json, manipulate version counters, and perform repeated ~20 MiB writes for disk exhaustion, though this does not affect collection or security policies.

## Affected products

- Netdata Netdata 2.0.0 to 2.10.x

## Timeline

- 2026-09-22: disclosed
- 2026-07-09: patched: Fix merged to master via PR #22896, released in 2.11.0

## References

- [https://github.com/netdata/netdata/commit/0124f50bbcf36c23e798e2b76f021f5032ec93d4](https://github.com/netdata/netdata/commit/0124f50bbcf36c23e798e2b76f021f5032ec93d4)
- [https://github.com/netdata/netdata/pull/22896](https://github.com/netdata/netdata/pull/22896)

## Related threats

- [Netdata ndsudo privilege escalation via fail2ban socket](https://junglewise.ai/threats/cve-2026-83603-netdata-is-an-open-source-observability-tool-prior-to-2-10-4-the)
- [Netdata heap buffer overflow in pluginsd DIMENSION SLOT parsing](https://junglewise.ai/threats/cve-2026-83601-netdata-is-an-open-source-observability-tool-prior-to-2-10-4-an)
- [Netdata denial of service via oversized CHART SLOT value](https://junglewise.ai/threats/cve-2026-83600-netdata-is-an-open-source-observability-tool-prior-to-2-10-4-an)
- [Netdata WebSocket decompression bomb denial of service](https://junglewise.ai/threats/cve-2026-83599-netdata-is-an-open-source-observability-tool-prior-to-2-11-0)
- [Netdata reflected XSS in ilove.svg endpoint](https://junglewise.ai/threats/cve-2025-71385-netdata-reflected-xss-in-ilove-svg-endpoint)