Potential remote execution on Agents with an exposed web port (19999)

Update timeline

1. investigating Oct 23, 2026, 12:34 PM UTC

   A vulnerability in Netdata Agent was publicly disclosed. An attacker with access to the local web port (19999) or the Netdata Cloud space the Agent is claimed to, may execute arbitrary commands as the `netdata` user. Full details of the vulnerability are in the dislosure here: https://codeberg.org/x509dot/vulns/src/branch/main/netdata-rce.md. We have fixed the issue and created a new nightly/edge build of the Agent (https://github.com/netdata/netdata-nightlies/releases/tag/v2.12.0-267-nightly) and a new patch release v2.12.2 for our stable channel should be published shortly. We will update this incident when that build has been published. Mitigation: limiting access to the web port of the Agent lowers the possibility of an attacker to exploit this vulnerability. Instructions on securing Agents can be found here: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents, with serveral approaches including binding the port to localhost, requiring bearer tokens, or disabling the web port completely. Parent Agents, however, require their web port to remain available to Child Agents for streaming. Access lists can be used to limit access: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents/web-server-reference#access-lists Evidence of compromise can be found with this script: https://gist.github.com/ktsaou/b3fcf41c8ce0a01effb6df9d82a14858

2. identified Oct 23, 2026, 12:35 PM UTC

   The issue has been identified and a fix is being implemented.

3. monitoring Oct 23, 2026, 01:34 PM UTC

   The version 2.12.2 patch release has been published to the stable release channel with a fix for the issue.