Potential remote execution on Agents with an exposed web port (19999)
View the provider incident record →Current answer
Netdata experienced a minor incident: Potential remote execution on Agents with an exposed web port (19999). The provider currently marks this incident Monitoring.
Looking for an update now? Check the current status, or follow Netdata for future changes.
Incident Lifecycle
Affected Components
Agent (all platforms)
Incident Timeline
Monitoring
The version 2.12.2 patch release has been published to the stable release channel with a fix for the issue.
Oct 23, 2026 at 1:34 PM UTC
Identified
The issue has been identified and a fix is being implemented.
Oct 23, 2026 at 12:35 PM UTC
Investigating
A vulnerability in Netdata Agent was publicly disclosed. An attacker with access to the local web port (19999) or the Netdata Cloud space the Agent is claimed to, may execute arbitrary commands as the `netdata` user.
Full details of the vulnerability are in the dislosure here: https://codeberg.org/x509dot/vulns/src/branch/main/netdata-rce.md.
We have fixed the issue and created a new nightly/edge build of the Agent (https://github.com/netdata/netdata-nightlies/releases/tag/v2.12.0-267-nightly) and a new patch release v2.12.2 for our stable channel should be published shortly. We will update this incident when that build has been published.
Mitigation: limiting access to the web port of the Agent lowers the possibility of an attacker to exploit this vulnerability. Instructions on securing Agents can be found here: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents, with serveral approaches including binding the port to localhost, requiring bearer tokens, or disabling the web port completely.
Parent Agents, however, require their web port to remain available to Child Agents for streaming. Access lists can be used to limit access: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents/web-server-reference#access-lists
Evidence of compromise can be found with this script: https://gist.github.com/ktsaou/b3fcf41c8ce0a01effb6df9d82a14858
Full details of the vulnerability are in the dislosure here: https://codeberg.org/x509dot/vulns/src/branch/main/netdata-rce.md.
We have fixed the issue and created a new nightly/edge build of the Agent (https://github.com/netdata/netdata-nightlies/releases/tag/v2.12.0-267-nightly) and a new patch release v2.12.2 for our stable channel should be published shortly. We will update this incident when that build has been published.
Mitigation: limiting access to the web port of the Agent lowers the possibility of an attacker to exploit this vulnerability. Instructions on securing Agents can be found here: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents, with serveral approaches including binding the port to localhost, requiring bearer tokens, or disabling the web port completely.
Parent Agents, however, require their web port to remain available to Child Agents for streaming. Access lists can be used to limit access: https://learn.netdata.cloud/docs/netdata-agent/configuration/securing-agents/web-server-reference#access-lists
Evidence of compromise can be found with this script: https://gist.github.com/ktsaou/b3fcf41c8ce0a01effb6df9d82a14858
Oct 23, 2026 at 12:34 PM UTC
Was your business affected by this Netdata outage?
Follow Netdata and route available status alerts to email or a team channel.