Netdata
Monitoring · products/netdata.yaml · RSS
Latest 2.12.1 Oct 8, 2026
Recent releases
breakingRemoved a scan of the open cache that ran on every dbengine datafile deletion only to feed a debug check compiled out of release builds. The scan walked the whole clean queue under its lock, which can be large on busy Parents ()
breakingCeph: removed a stray option selector from the configuration form, and stopped the Redfish TLS settings from rendering a duplicate tab strip ()
breakingFixed go.d collection status reporting: V2 collection status and duration charts were restored, Function failures are reported and the finalizer context honored, job-scoped Function metadata is returned, accepted job activation converges asynchronously, shutdown errors are preserved through…
breakingRemoved the unused registry_generate_curl_urls function, and corrected stale comments and test diagnostics (daemon). ()
breakingRemoved a per-chart label probe from the pulse child charts, relying on the host label-version compare instead; on a parent with 808 children the probe accounted for about 23% of the main pulse thread and left gaps in the netdata.* charts it emits ()
securitySecurity Hardening
breakingRemoved the Go sensors collector, superseded since v2.2.0 by the C libsensors module in debugfs.plugin (go.d/sensors). ()
securityAdded a Netdata and cyber-security document, and updated Windows installer and plugin documentation. ()
securityFixes CVE-2026-83603: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
securityFixes CVE-2026-83598: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair
securityFixes CVE-2026-83599: WebSocket Decompression Bomb
breakingRemoved the unused extra_details field from the go.d/powerstore Hardware struct to fix /hardware response decoding errors that caused job check failures ()
breakingRemoved legacy MSSQL collector from Windows plugin, completing migration to go.d (windows.plugin). ()
breakingRemoved compilation warnings across Linux, Windows, BSD platforms and removed variable-length arrays for C11+ compatibility (build). ()
breakingRemoved per-metric collect_* options from MSSQL go.d collector - all metrics now always collected (go.d/mssql). ()
securityAdded documentation recommending bearer token protection as the preferred security method ()
breakingRemoved obsolete TODO documentation files. ()
securityUpdated the Netdata Docker image to Debian 13.3 with the latest upstream updates and security fixes
breakingRemoved the strict rabbitmq_version check to improve RabbitMQ collector compatibility with older brokers ()
breakingRemoved noisy INFO log from Windows datafile sync to reduce log spam during periodic syncs ()
Security advisories
6.5 CVE-2026-83602 Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK
6.5 CVE-2026-83600 Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent
6.5 CVE-2026-83601 Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write
7.0 CVE-2026-83597 Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution
7.8 CVE-2026-83598 Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair