Minor incident

Netdata: Potential remote execution on Agents with an exposed web port (19999)

Affected: Agent (all platforms)

Current status of Netdata: Operational — live Netdata status

Timeline

1. Oct 22, 2026, 05:57 UTC
   investigating
   A vulnerability in Netdata Agent was publicly disclosed. An attacker with access to the local web port (19999) or the Netdata Cloud space the Agent is claimed to, may execute arbitrary commands as the `netdata` user. Full details of the vulnerability are in the dislosure here: https://codeberg.org/x509dot/vulns/src/branch/main/netdata-rce.md. We have fixed the issue and created a new nightly/edge build of the Agent (https://github.com/netdata/netdata-nightlies/releases/tag/v2.12.0-267-nightly) and a new patch release v2.12.2 for our stable channel should be published shortly. We will update this incident when that build has been published. Mitigation: limiting access to the web port of the Agent lowers the possibility of an attacker to exploit this vulnerability. Instructions on securing Agents can be found here: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents, with serveral approaches including binding the port to localhost, requiring bearer tokens, or disabling the web port completely. Parent Agents, however, require their web port to remain available to Child Agents for streaming. Access lists can be used to limit access: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents/web-server-reference#access-lists Evidence of compromise can be found with this script: https://gist.github.com/ktsaou/b3fcf41c8ce0a01effb6df9d82a14858
2. Oct 23, 2026, 12:35 UTC
   identified
   The issue has been identified and a fix is being implemented.
3. Oct 23, 2026, 13:34 UTC
   monitoring
   The version 2.12.2 patch release has been published to the stable release channel with a fix for the issue.

Updates as published by Netdata (original).