Monitoring - The version 2.12.2 patch release has been published to the stable release channel with a fix for the issue.
Oct 23, 2026 - 13:34 UTC
Oct 23, 2026 - 13:34 UTC
Identified - The issue has been identified and a fix is being implemented.
Oct 23, 2026 - 12:35 UTC
Oct 23, 2026 - 12:35 UTC
Investigating - A vulnerability in Netdata Agent was publicly disclosed. An attacker with access to the local web port (19999) or the Netdata Cloud space the Agent is claimed to, may execute arbitrary commands as the `netdata` user.
Full details of the vulnerability are in the dislosure here: https://codeberg.org/x509dot/vulns/src/branch/main/netdata-rce.md.
We have fixed the issue and created a new nightly/edge build of the Agent (https://github.com/netdata/netdata-nightlies/releases/tag/v2.12.0-267-nightly) and a new patch release v2.12.2 for our stable channel should be published shortly. We will update this incident when that build has been published.
Mitigation: limiting access to the web port of the Agent lowers the possibility of an attacker to exploit this vulnerability. Instructions on securing Agents can be found here: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents, with serveral approaches including binding the port to localhost, requiring bearer tokens, or disabling the web port completely.
Parent Agents, however, require their web port to remain available to Child Agents for streaming. Access lists can be used to limit access: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents/web-server-reference#access-lists
Evidence of compromise can be found with this script: https://gist.github.com/ktsaou/b3fcf41c8ce0a01effb6df9d82a14858
Oct 22, 2026 - 05:57 UTC
Full details of the vulnerability are in the dislosure here: https://codeberg.org/x509dot/vulns/src/branch/main/netdata-rce.md.
We have fixed the issue and created a new nightly/edge build of the Agent (https://github.com/netdata/netdata-nightlies/releases/tag/v2.12.0-267-nightly) and a new patch release v2.12.2 for our stable channel should be published shortly. We will update this incident when that build has been published.
Mitigation: limiting access to the web port of the Agent lowers the possibility of an attacker to exploit this vulnerability. Instructions on securing Agents can be found here: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents, with serveral approaches including binding the port to localhost, requiring bearer tokens, or disabling the web port completely.
Parent Agents, however, require their web port to remain available to Child Agents for streaming. Access lists can be used to limit access: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents/web-server-reference#access-lists
Evidence of compromise can be found with this script: https://gist.github.com/ktsaou/b3fcf41c8ce0a01effb6df9d82a14858
Oct 22, 2026 - 05:57 UTC
Cloud Web UI
Operational
Cloud Alerts
Operational
Cloud Charts
Operational
Cloud Event Feed
Operational
Cloud Payment
Operational
Agent - Cloud Connection (ACLK)
Operational
Agent (all platforms)
Operational
Agent Repositories
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.