CVE-2023-22496Netdata Command Injection
An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent.
Published Jan 14, 2023 · Updated Aug 12, 2026 · Also known as DEBIAN-CVE-2023-22496, GHSA-xg38-3vmw-2978
Key Facts
Patch immediately- CVE-2023-22496 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Netdata.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 36% probability of exploitation in the next 30 days.
- Fixed versions are available, including Netdata 1.37.0-1, Netdata 1.37.0.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
36%
Higher than 98.4% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
44/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the function health_alarm_execute is called.
This function performs different checks and then enqueues a command by calling spawn_enq_cmd. This command is populated with several arguments that are not sanitized. One of them is the registry_hostname of the node for which the alert is raised.
By providing a specially crafted registry_hostname as part of the health data that is streamed to a Netdata (parent) agent, an attacker can execute arbitrary commands at the remote host as a side-effect of the raised alert. Note that the commands are executed as the user running the Netdata Agent. This user is usually named netdata.
The ability to run arbitrary commands may allow an attacker to escalate privileges by escalating other vulnerabilities in the system, as that user. The problem has been fixed in: Netdata agent v1.37 (stable) and Netdata agent v1.36.0-409 (nightly). As a workaround, streaming is not enabled by default.
If you have previously enabled this, it can be disabled. Limiting access to the port on the recipient Agent to trusted child connections may mitigate the impact of this vulnerability.
Affected Products
13 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| NetdataNetdata | >= < 1.36.0-409 | 1.37.0 |
Patched Releases
Netdata
1.37.0-1, 1.37.0
Timeline
Publicly disclosed
Jan 14, 2023
Last updated
Aug 12, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
FAQ
Common Questions.
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting.
Affected: Netdata versions >= < 1.36.0-409. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Netdata 1.37.0-1, Netdata 1.37.0.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2023-22496 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo