Homepage

External Control of File Name or Path Affecting netdata-fips-2.10 package, versions <2.10.4-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.32% (23rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-NETDATAFIPS210-20343428
  • published1 Oct 2026
  • disclosed22 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 22 Sep 2026

NewCVE-2026-83603  (opens in a new tab)
CWE-73  (opens in a new tab)
CWE-502  (opens in a new tab)

How to fix?

Upgrade Minimos:latest netdata-fips-2.10 to version 2.10.4-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream netdata-fips-2.10 package and not the netdata-fips-2.10 package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The account can direct root fail2ban-client to a malicious UNIX socket, and fail2ban/client/csocket.py CSocket.receive() passes the returned data to pickle.loads(), allowing attacker-controlled code to execute as root on systems with fail2ban-client installed. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.