# CVE-2026-83603: Netdata ndsudo privilege escalation via fail2ban socket

Source: https://junglewise.ai/threats/cve-2026-83603-netdata-is-an-open-source-observability-tool-prior-to-2-10-4-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-83603 · Severity: high · CVSS 8.4 · Published 2026-09-22

Netdata is an open source monitoring and observability platform. A setuid-root helper command in Netdata prior to 2.10.4 accepts caller-controlled socket paths and passes data to Python's pickle.loads(), allowing arbitrary code execution as root on systems with fail2ban-client installed. An attacker with access to the low-privileged netdata service account can exploit this to gain root-level control.

Technologies: [Netdata](https://junglewise.ai/threats/technologies/netdata). Vendors: [Netdata](https://junglewise.ai/threats/vendors/netdata).

## Quick answers

**Is CVE-2026-83603 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83603 being exploited in the wild.

**How severe is CVE-2026-83603?** High severity, with a CVSS score of 8.4, published 22 September 2026.

**Which products and versions are affected?** Netdata prior to 2.10.4.

**Is there a fix for CVE-2026-83603?** A patch was published on 2026-06-16: Fixed in version 2.10.4 and nightly build 2.10.0-782-nightly Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-83603 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-83603?** Check whether you run Netdata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ndsudo setuid-root helper in src/collectors/utils/ndsudo.c accepts an attacker-controlled --socket_path parameter from the netdata service account and passes it to fail2ban-client. The fail2ban/client/csocket.py CSocket.receive() method deserializes returned data with pickle.loads() without validation, enabling arbitrary code execution as root. This requires fail2ban-client to be installed and accessible, and the netdata service to be running.

## Affected products

- Netdata Netdata prior to 2.10.4

## Timeline

- 2026-09-22: disclosed
- 2026-06-16: patched: Fixed in version 2.10.4 and nightly build 2.10.0-782-nightly

## References

- [https://github.com/netdata/netdata/commit/9bced8d46464bd0fe01b0b5f8c63c4ac24e9b060](https://github.com/netdata/netdata/commit/9bced8d46464bd0fe01b0b5f8c63c4ac24e9b060)
- [https://github.com/netdata/netdata/pull/22745](https://github.com/netdata/netdata/pull/22745)

## Related threats

- [Netdata API access control bypass in /api/v3/settings](https://junglewise.ai/threats/cve-2026-83602-netdata-is-an-open-source-observability-tool-from-2-0-0-until-2)
- [Netdata heap buffer overflow in pluginsd DIMENSION SLOT parsing](https://junglewise.ai/threats/cve-2026-83601-netdata-is-an-open-source-observability-tool-prior-to-2-10-4-an)
- [Netdata denial of service via oversized CHART SLOT value](https://junglewise.ai/threats/cve-2026-83600-netdata-is-an-open-source-observability-tool-prior-to-2-10-4-an)
- [Netdata WebSocket decompression bomb denial of service](https://junglewise.ai/threats/cve-2026-83599-netdata-is-an-open-source-observability-tool-prior-to-2-11-0)
- [Netdata reflected XSS in ilove.svg endpoint](https://junglewise.ai/threats/cve-2025-71385-netdata-reflected-xss-in-ilove-svg-endpoint)