Netdata versions 2.0.0 through 2.10.x are vulnerable to an unauthenticated access control bypass that permits attackers to consume system disk space via unauthorized API requests.

The vulnerability resides in the /api/v3/settings endpoint, where improper access control configuration allows unauthenticated attackers to bypass dashboard IP restrictions. By sending malicious PUT requests, an attacker can persistently write arbitrary JSON data to the local disk, facilitating a denial of service through disk space exhaustion.

Successful exploitation of this vulnerability poses a risk to system availability and storage integrity. An attacker can perform repeated write operations to fill the disk partition, which may result in a denial of service for the Netdata service or the host system. With a CVSS score of 6.5, this medium-severity vulnerability necessitates prompt attention to prevent unauthorized data persistence and potential service disruption.

Immediate Action: Update the Netdata installation to version 2.11.0 or later to apply the necessary access control restrictions.

Proactive Monitoring: Monitor disk usage metrics on servers hosting Netdata and review web access logs for anomalous, high-frequency PUT requests targeting the /api/v3/settings endpoint.

Compensating Controls: Implement network-level access control lists or a Web Application Firewall to restrict access to the Netdata API to authorized IP addresses only.

Public Exploit Available: No

Given the ease of exploitation and the potential for disk exhaustion, administrators should prioritize updating Netdata to version 2.11.0. If an immediate update is not feasible, ensure that the Netdata interface is not exposed to the public internet and restrict access to trusted management networks to mitigate the risk of unauthorized API interaction.