Netdata from version 2.0.0 up to, but not including, the fixed release 2.11.0 registers the /api/v3/settings endpoint with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA. This configuration allows unauthenticated users to send PUT requests to modify the system settings. An attacker who discovers the API can persist malicious JSON payloads in the {varlib}/settings/default.json file, alter the version counter, and repeatedly write nearly 20 MiB blocks to consume disk space. Although the modified file does not directly control the collection or security policy, the ability to unduly alter configuration data and consume storage can disrupt service operation and compromise system integrity.

All Netdata installations running the open‑source observability tool from release 2.0.0 through the pre‑2.11.0 series are affected. The vulnerability was fixed in release 2.11.0; systems currently running 2.11.0 or later are not impacted by this specific issue.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The vulnerability is exploitable by any network-reachable actor: the API endpoint accepts unauthenticated PUT requests over HTTP, and the broken IP allowlist does not constrain the attacker's location. An attacker can therefore tamper with Netdata’s configuration globally and may achieve a denial‑of‑service scenario by exhausting disk space through repeated writes. Given the ease of exploitation and the lack of authentication or address‑based checks, the risk to exposed systems remains high until mitigated.