Potential remote execution on Agents with an exposed web port (19999)

Incident Report for Netdata

Monitoring

The version 2.12.2 patch release has been published to the stable release channel with a fix for the issue.

Posted Oct 23, 2026 - 13:34 UTC

The issue has been identified and a fix is being implemented.

Posted Oct 23, 2026 - 12:35 UTC

A vulnerability in Netdata Agent was publicly disclosed. An attacker with access to the local web port (19999) or the Netdata Cloud space the Agent is claimed to, may execute arbitrary commands as the `netdata` user.

Full details of the vulnerability are in the dislosure here: https://codeberg.org/x509dot/vulns/src/branch/main/netdata-rce.md.

We have fixed the issue and created a new nightly/edge build of the Agent (https://github.com/netdata/netdata-nightlies/releases/tag/v2.12.0-267-nightly) and a new patch release v2.12.2 for our stable channel should be published shortly. We will update this incident when that build has been published.

Mitigation: limiting access to the web port of the Agent lowers the possibility of an attacker to exploit this vulnerability. Instructions on securing Agents can be found here: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents, with serveral approaches including binding the port to localhost, requiring bearer tokens, or disabling the web port completely.

Parent Agents, however, require their web port to remain available to Child Agents for streaming. Access lists can be used to limit access: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents/web-server-reference#access-lists

Evidence of compromise can be found with this script: https://gist.github.com/ktsaou/b3fcf41c8ce0a01effb6df9d82a14858

Posted Oct 22, 2026 - 05:57 UTC

This incident affects: Agent (all platforms).