Netdata EUVD-2026-84562

Requires only network reachability to a Netdata instance's HTTP/dashboard listener (default TCP 19999) on affected versions 2.0.0 through 2.10.x; no authentication or user interaction is needed because /api/v3/settings was served with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA. The distinctive security condition is that this endpoint bypasses the operator-configured 'allow dashboard from' per-feature IP allowlist - so the flaw is most impactful where an operator relied on that IP restriction to fence off the dashboard, since the settings PUT reaches through it. Impact is limited to writing/tampering the settings/default.json file and disk consumption via repeated ~20 MiB writes; it does not affect data collection, security policy, or confidentiality, which caps real-world severity.

This is a genuine but moderate-severity access-control flaw, not an overhyped high-CVSS issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, base 6.5) is internally consistent with the description: a network-reachable, unauthenticated PUT to /api/v3/settings that was registered with HTTP_ACL_NOCHECK, confirmed directly by the PR #22896 source diff which changes the ACL to HTTP_ACL_DASHBOARD. Impact is correctly scoped as low integrity (attacker persists JSON in settings/default.json and tampers with a version counter) and low availability (repeated ~20 MiB writes fill disk), with no confidentiality impact - the advisory and description both stress the file does not control data collection or security policy, so this is not privilege escalation or RCE. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The C:N/I:L/A:L profile means the practical worst case is nuisance-grade disk exhaustion and dashboard-setting tampering rather than compromise of monitoring integrity; realistic priority is medium. Note the tag 'Authentication Bypass' is imprecise - CWE-284 and the diff show this is an IP-allowlist (per-feature access-control) bypass, not authentication credential bypass.

An attacker who can reach a Netdata instance's HTTP port (default 19999) - including from an IP the operator intended to block via 'allow dashboard from' - sends unauthenticated PUT requests to /api/v3/settings, writing attacker-controlled JSON into {varlib}/settings/default.json and bumping its version counter. By repeating near-20 MiB writes the attacker consumes disk space on the monitoring host, potentially degrading the agent or the underlying system. No public exploit code is identified, but the attack requires only ordinary HTTP requests with low complexity.