Netdata allows a local attacker who can influence the low‑privileged Netdata service account to supply a malicious --socket_path to the setuid‑root helper ndsudo. The helper starts fail2ban‑client directed at that socket, and fail2ban’s network client passes the received payload to pickle.loads(), which executes attacker‑controlled code with root privileges. This flaw can provide full root access to the system in which Netdata and fail2ban are installed.

The vulnerability exists in Netdata prior to release 2.10.4. Any deployment running a version older than 2.10.4 on a system that has fail2ban-client installed is affected. Netdata’s setuid‑root ndsudo helper and the fail2ban client form the affected components.

The CVSS score of 8.4 indicates a high severity. EPSS is not available, so exploitation likelihood is uncertain but the flaw requires local access to the Netdata service account. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to be able to influence the Netdata service’s execution context, which is a local constraint inferred from the description.