Netdata 2.8.1 → 2.10.4
10 releases · 11 breaking changes · 13 security fixes · 7 advisories fixed
13security11breaking3deprecated70feature40fix
Vulnerabilities fixed by this upgrade
- 8.4 CVE-2026-83603 Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
- 6.5 CVE-2026-83602 Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK
- 6.5 CVE-2026-83600 Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent
- 6.5 CVE-2026-83601 Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write
- 7.5 CVE-2026-83599 WebSocket Decompression Bomb
- 7.0 CVE-2026-83597 Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution
- 7.8 CVE-2026-83598 Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair
Breaking changes
- breaking Removed the unused extra_details field from the go.d/powerstore Hardware struct to fix /hardware response decoding errors that caused job check failures () in 2.10.3
- breaking Removed legacy MSSQL collector from Windows plugin, completing migration to go.d (windows.plugin). () in 2.10.0
- breaking Removed compilation warnings across Linux, Windows, BSD platforms and removed variable-length arrays for C11+ compatibility (build). () in 2.10.0
- breaking Removed per-metric collect_* options from MSSQL go.d collector - all metrics now always collected (go.d/mssql). () in 2.9.0
- breaking Removed obsolete TODO documentation files. () in 2.9.0
- breaking Removed third-party network device Prometheus exporters from documentation. () in 2.9.0
- breaking Removed Docker prerequisite to install smartmontools as it's now included in helper images. () in 2.9.0
- breaking Removed snippet with broken link from go_expvar metadata. () in 2.9.0
- breaking Removed redundant libuv loop calls to improve event loop stability and reduce overhead () in 2.9.0
- breaking Removed Sentry error reporting from journal-viewer plugin () in 2.9.0
- breaking Removed the strict rabbitmq_version check to improve RabbitMQ collector compatibility with older brokers () in 2.8.3
Security changes
- security Fixes CVE-2026-83603: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE in 2.10.4
- security Fixes CVE-2026-83598: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair in 2.10.4
- security Fixes CVE-2026-83599: WebSocket Decompression Bomb in 2.10.4
- security Fixes CVE-2026-83597: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution in 2.10.4
- security Fixes CVE-2026-83602: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK in 2.10.4
- security Fixes CVE-2026-83600: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent in 2.10.4
- security Fixes CVE-2026-83601: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write in 2.10.4
- security The /api/v3/settings endpoint is now gated behind HTTP_ACL_DASHBOARD instead of HTTP_ACL_NOCHECK, enforcing connection allowlists and blocking anonymous state-changing requests () in 2.10.4
- security Fixed the csvjsonarray output format emitting invalid JSON when label-quotes is passed () in 2.10.4
- security Added documentation recommending bearer token protection as the preferred security method () in 2.9.0
- security Added SOC 2 Type 2 compliance badge to Security and Privacy documentation. () in 2.9.0
- security Updated security and privacy design links in map.csv. () in 2.9.0
- security Updated the Netdata Docker image to Debian 13.3 with the latest upstream updates and security fixes in 2.8.5
Deprecations
- deprecated Deprecation notice in 2.10.0
- deprecated Added deprecation notice for /api/v1/charts endpoint () in 2.10.0
- deprecated Deprecation notice in 2.9.0
Every release in between
securityFixes CVE-2026-83603: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
securityFixes CVE-2026-83598: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair
securityFixes CVE-2026-83599: WebSocket Decompression Bomb
securityFixes CVE-2026-83597: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution
securityFixes CVE-2026-83602: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK
securityFixes CVE-2026-83600: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent
securityFixes CVE-2026-83601: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write
featuremacOS hardware sensor collectors: GPU power, clock, and temperatures, SMC and IOHID sensors and fans, power sources and thermal pressure, NVMe SMART, with a powermetrics fallback via ndsudo, plus a cross-OS sensors function and a shared temperature-histogram context ()
featureBounded-cardinality process grouping for apps.plugin on macOS, keeping per-process monitoring meaningful on hosts with high process churn ()
otherHardened DBENGINE against corrupted or truncated data files: extent disk-size and uncompressed-page-bounds validation, SIGBUS protection and header-offset bounds checks on v2 journal walks, improved journal file access error handling, and spinlock-holder identification for datafile/journal…
fixFixed page-cache races in pgc_page_add and pgc_queue_del, a deadlock on dimension creation, and a crash on virtual node takeover ()
fixValidated data loaded from SQLite to prevent crashes on corrupted databases, and improved UUID handling and error reporting in SQLite functions ()
otherKept chart indexes allocated while a host is archived and guarded against a null root index in chart lookups, avoiding null dereferences during queries ()
fixFixed an rrdcontext metadata leak on non-dbengine hosts ()
otherRotated the active datafile and requeued the pending extent on unrecoverable write errors, so a failing disk no longer stalls the database engine ()
fixTracked and accounted memory allocation size in replication queries, and fixed a sender replication counter leak on obsolete charts ()
otherRejected oversized ZSTD frames and handled decompression errors gracefully (log and fail the connection instead of fatal()) ()
fixFixed the streaming receiver discarding already-delivered data when a child disconnects ()
otherPrevented rare unbounded one-core CPU spins in the cloud-connection loops, and avoided returning an uninitialized packet_id on publish failure (;)
fixBounded the alert notification execution wait so a stuck notification script cannot block progress, and fixed a shutdown race when restoring alert information from the database ()
featureAdded safeguards against ML database corruption and streamlined the recovery process ()
fixFixed systemd-journal.plugin memory retention after queries and its apps.plugin accounting ()
fixFixed file descriptor accounting in apps.plugin (adding nfds monitoring) and eBPF FD PID map iteration (;)
fixFixed buffer overflows and counter-size issues in platform collectors: a stack buffer overflow in macOS mach_smi, FreeBSD counter size mismatches and an off-by-one in freebsd_ipfw and the claim code, and a freeipmi.plugin watchdog underflow at low system uptime (;;;)
fixFixed Windows Events row rendering crashes with stricter size checks, safer XML parsing, and robust variant handling ()
otherRestored stable temperature and power collection in go.d/nvidia_smi with NVIDIA driver 580 XML output variants ()
fixFixed Windows hardware detection so virtual machines are no longer reported as bare metal ()
otherMoved the fail2ban socket path into ndsudo for go.d/fail2ban ()
fixFixed a pluginsd cleanup race with an active collector, added a slot bounds check to the pluginsd parser, and initialized mountpoint state before the slow worker in the diskspace plugin ()
securityThe /api/v3/settings endpoint is now gated behind HTTP_ACL_DASHBOARD instead of HTTP_ACL_NOCHECK, enforcing connection allowlists and blocking anonymous state-changing requests ()
securityFixed the csvjsonarray output format emitting invalid JSON when label-quotes is passed ()
fixFixed internal race conditions: a TOCTOU race in dictionary_destroy(), ARAL allocator races and a double-free ()
fixFixed a payload memory leak, JSON object validation and null-key handling, an inverted empty-buffer guard in simple_pattern, and prevented a concurrent fatal from masking the first one (;)
fixFixed memory-safety and correctness bugs surfaced by Coverity and Sonar audits (;)
fixImproved shutdown robustness: fixed a SIGSEGV in ctx_hosts_load and pipe cleanup handling of the ENOENT case ()
otherNetdata Learn: Find documentation, guides, and reference material for monitoring and troubleshooting your systems with Netdata.
fixGitHub Issues: Make use of the Netdata repository to report bugs or open a new feature request.
otherGitHub Discussions: Join the conversation around the Netdata development process and be a part of it.
otherCommunity Forums: Visit the Community Forums and contribute to the collaborative knowledge base.
otherDiscord Server: Jump into the Netdata Discord and hang out with like-minded sysadmins, DevOps, SREs, and other troubleshooters. More than 2000 engineers are already using it!
fixFixed a per-PID shared-memory pool leak in ebpf.plugin that, on hosts with normal process churn, filled the 32,768-slot pool within ~15 hours and then pegged a CPU core at 100% in an infinite map-iteration loop; aggregation paths now use a non-allocating lookup, freshly-allocated slots are zeroed,…
otherSwitched the SNMP collector's primary uptime source to SNMP-FRAMEWORK-MIB::snmpEngineTime (in seconds) to avoid the ~497-day TimeTicks wrap of hrSystemUptime/sysUpTime, while keeping the existing systemUptime metric name and HR-MIB fallback ()
otherSplit dynamic configuration job-name validation per domain so service discovery, vnode, and secret-store names can include dots (e.g., FQDNs), while collectors retain strict naming rules ()
breakingRemoved the unused extra_details field from the go.d/powerstore Hardware struct to fix /hardware response decoding errors that caused job check failures ()
otherNetdata Learn: Find documentation, guides, and reference material for monitoring and troubleshooting your systems with Netdata.
fixGitHub Issues: Make use of the Netdata repository to report bugs or open a new feature request.
otherGitHub Discussions: Join the conversation around the Netdata development process and be a part of it.
otherCommunity Forums: Visit the Community Forums and contribute to the collaborative knowledge base.
otherDiscord Server: Jump into the Netdata Discord and hang out with like-minded sysadmins, DevOps, SREs, and other troubleshooters. More than 2000 engineers are already using it!
fixFixed ZFS-related crashes in diskspace.plugin by guarding a NULL filesystem field and replacing the blocking pool-capacity collector with a lightweight cache fed by existing statvfs calls, preventing coredumps on degraded or exporting ZFS pools ()
otherReduced default SNMP MaxOIDs from 60 to 20 for more reliable polling, and removed 32-bit counter fallbacks from the IF-MIB profile to prevent counter type switching and overflow between collection cycles ()
otherEliminated false-positive "timed out waiting for enable/disable decision" warnings by removing the wait-decision timeout and making the dyncfg command path non-droppable, so back-pressure flows upstream instead of producing 503 errors ()
otherNetdata Learn: Find documentation, guides, and reference material for monitoring and troubleshooting your systems with Netdata.
fixGitHub Issues: Make use of the Netdata repository to report bugs or open a new feature request.
otherGitHub Discussions: Join the conversation around the Netdata development process and be a part of it.
otherCommunity Forums: Visit the Community Forums and contribute to the collaborative knowledge base.
otherDiscord Server: Jump into the Netdata Discord and hang out with like-minded sysadmins, DevOps, SREs, and other troubleshooters. More than 2000 engineers are already using it!
featureAdded ping_only option to the SNMP collector, allowing collection of only ICMP round-trip time metrics while still using SNMP at startup for device identification and labeling ()
fixFixed SNMP collector retries serialization so a zero value is correctly preserved, and disabled bulk walk detection when MaxRepetitions is set to 0 ()
otherReduced transient 503 errors on dynamic configuration enable/disable by buffering the command channel and extending the handoff timeout in the go.d plugin ()
otherNetdata Learn: Find documentation, guides, and reference material for monitoring and troubleshooting your systems with Netdata.
fixGitHub Issues: Make use of the Netdata repository to report bugs or open a new feature request.
otherGitHub Discussions: Join the conversation around the Netdata development process and be a part of it.
otherCommunity Forums: Visit the Community Forums and contribute to the collaborative knowledge base.
otherDiscord Server: Jump into the Netdata Discord and hang out with like-minded sysadmins, DevOps, SREs, and other troubleshooters. More than 2000 engineers are already using it!
deprecatedDeprecation notice
featureSecrets are resolved each time a collector job starts or restarts.
featureUpdating a secretstore automatically restarts collector jobs that use it so they pick up new credentials.
featureSecretstore configuration values themselves also support ${env:...}, ${file:...}, and ${cmd:...} resolvers, so backend credentials don't need to be stored in plain text either.
featureGraphically Evaluate Alerts on historical data before they are deployed
featureCreate complex recurrence rules on Alerts Silencing to manage your maintenance windows
featureAcknowledge Alerts that your teams are working on
featureAdd metrics charts, logs, live functions, events feeds, active alerts counts, node list, etc.
featureDuplicate Dashboards to help create new custom dashboards from existing ones
featureAdded secrets management support, allowing collector credentials to be stored in external secret stores like AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, and HashiCorp Vault (go.d). ()
featureRewrote scripts.d collector to V2 framework with alertable state support for Nagios-style custom scripts (go.d/scripts.d). ()
featureAdded Azure Monitor collector for monitoring Azure cloud resources with built-in alerts (go.d/azure_monitor). ()
featureAdded Azure AD authentication support for MSSQL, PostgreSQL, and generic SQL collectors (go.d). ()
featureAdded Dell PowerVault ME4/ME5 storage array collector with system health, hardware status, performance, and capacity monitoring (go.d/powervault). ()
featureAdded Dell PowerStore storage array collector with cluster, appliance, volume, node, and hardware monitoring (go.d/powerstore). ()
featureAdded Always On Availability Group monitoring to MSSQL collector with AG health, replica states, sync metrics, and WSFC cluster status (go.d/mssql). ()
featureAdded IPSec/VPN monitoring profiles for FortiGate, Juniper, MikroTik, and Check Point (go.d/snmp). ()
featureAdded per-Windows-service process tree grouping to apps.plugin with auto-discovery via Service Control Manager (apps.plugin). ()
featureAdded datastore, cluster, and resource pool monitoring to vSphere collector with capacity, IOPS, and latency metrics (go.d/vsphere). ()
featureAdded Docker container listi1ng function for interactive container overview in the dashboard (go.d/docker). ()
featureIntroduced V2 metrics collection framework with float dimension support, structured family handling, and redesigned function management (go.d). ()
breakingRemoved legacy MSSQL collector from Windows plugin, completing migration to go.d (windows.plugin). ()
featureAdded conditional and rate-limited logging to go.d logger (go.d). ()
featureAdded and improved Secrets Management documentation with secret store backend guides ()
featureAdded Windows Authentication setup guide for MSSQL collector ()
featureAdded section on changing the default port ()
featureAdded NVIDIA/Cumulus/Mellanox to SNMP collector vendor list ()
featureAdded Installation section to metrics-centralization-points README ()
featureAdded Space Settings navigation guidance to remove-node.md ()
featureAdded file permissions and ownership documentation for claim.conf ()
deprecatedAdded deprecation notice for /api/v1/charts endpoint ()
featureAdded cloud.d directory contents section to claim README ()
featureAdded multi-device SNMPv3 configuration example with YAML anchors ()
featureAdded query metrics skill documentation with troubleshooting FAQ ()
featureAdded User Statistics prerequisite for MySQL per-user metrics ()
featureAdded TV Mode documentation section ()
featureAdded periodic timezone refresh for correct DST handling across all components (daemon). ()
featureAdded rejection of incoming streaming connections for locally collected vnodes (streaming). ()
featureAdded SOCKS5 and SOCKS5H proxy support to ACLK for environments requiring SOCKS proxies (ACLK). ()
breakingRemoved compilation warnings across Linux, Windows, BSD platforms and removed variable-length arrays for C11+ compatibility (build). ()
+91 more items in the release notesdeprecatedDeprecation notice
featureIdentify resource hogs: Sort by total execution time, CPU time, or I/O
featureSpot frequent queries: Find high-call-count queries that may benefit from caching
featureDebug in real-time: See currently running queries and which client initiated them
featureNo extra tools needed: All analysis happens in the Netdata dashboard's Top tab
featureQueries consuming the most total execution time or CPU
featureI/O patterns (logical reads, physical reads, writes)
featureMemory grants and tempdb usage
featureParallelism (DOP) across executions
featureLog Ingestion: Send logs from your OpenTelemetry Collector or instrumented applications directly to Netdata.
featureCustom Storage: Logs are stored in systemd-compatible journal files using a Rust implementation (no libsystemd dependency required).
featureUnified Interface: View OpenTelemetry logs alongside system logs in the Logs tab with full search and filtering capabilities.
featureSet limits by disk usage, file count, or age
featureDefine custom storage locations
featureTune file size and time span settings
featureAdded dynamic configuration support to go.d Service Discovery with UI-driven templates ()
featureAdded SNMP profile metadata mapping for “Westermo Teleindustri AB” to “Westermo” ()
featureAdded a dcgm collector for NVIDIA dcgm-exporter with full field classification ()
featureAdded jitter and variance metrics to the go.d ping collector ()
featureAdded a Kubernetes API Server collector ()
featureAdded function support to the go.d SQL collector to enable interactive, filterable table views in the Top tab ()
featureAdded PostgreSQL running-queries and enhanced top-queries support with pg_stat_monitor detection ()
featureAdded Windows support to hardware monitoring collectors with direct vendor CLI execution and improved reliability ()
featureAdded new cloud functions for MySQL and MSSQL to provide error and deadlock information ()
featureAdded smart ZFS dataset deduplication to the diskspace plugin to reduce duplicate reporting ()
featureAdded top-queries and running-queries functions for nine additional database collectors: Redis, ClickHouse, Elasticsearch, Couchbase, ProxySQL, OracleDB, CockroachDB, YugabyteDB, and RethinkDB (go.d). ()
featureAdded interface type categorization to SNMP collector for easier filtering (go.d/snmp). ()
featureAdded interfaces function for SNMP collector with per-interface traffic, packet, error/discard, and status metrics with computed rates (go.d/snmp). ()
featureImplemented Top Queries Functions framework for PostgreSQL, MySQL, MSSQL, and MongoDB with a reusable Functions API for building Netdata Functions in Go (go.d). ()
featureAdded a new Microsoft SQL Server (MSSQL) collector to go.d.plugin with comprehensive monitoring of connections, transactions, replication, and more (go.d/mssql). ()
breakingRemoved per-metric collect_* options from MSSQL go.d collector - all metrics now always collected (go.d/mssql). ()
securityAdded documentation recommending bearer token protection as the preferred security method ()
breakingRemoved obsolete TODO documentation files. ()
securityAdded SOC 2 Type 2 compliance badge to Security and Privacy documentation. ()
breakingRemoved third-party network device Prometheus exporters from documentation. ()
breakingRemoved Docker prerequisite to install smartmontools as it's now included in helper images. ()
breakingRemoved snippet with broken link from go_expvar metadata. ()
securityUpdated security and privacy design links in map.csv. ()
breakingRemoved redundant libuv loop calls to improve event loop stability and reduce overhead ()
breakingRemoved Sentry error reporting from journal-viewer plugin ()
+144 more items in the release notessecurityUpdated the Netdata Docker image to Debian 13.3 with the latest upstream updates and security fixes
otherStandardized alert configuration to use a consistent type for time group values ()
fixFixed CSV parser configuration serialization so empty settings are correctly omitted from logs configuration output ()
fixFixed ProxySQL backend status metrics in the go.d collector to correctly reflect reported backend states ()
fixFixed proc file parsing to support non-seekable files, restoring network stats collection on affected kernels ()
fixFixed edit-config to ignore inherited container environment values, preventing incorrect command handling ()
fixFixed vnode label configuration by allowing arbitrary label keys in the go.d schema, enabling labels to be set via the UI ()
otherNetdata Learn: Find documentation, guides, and reference material for monitoring and troubleshooting your systems with Netdata.
fixGitHub Issues: Make use of the Netdata repository to report bugs or open a new feature request.
otherGitHub Discussions: Join the conversation around the Netdata development process and be a part of it.
otherCommunity Forums: Visit the Community Forums and contribute to the collaborative knowledge base.
otherDiscord Server: Jump into the Netdata Discord and hang out with like-minded sysadmins, DevOps, SREs, and other troubleshooters. More than 2000 engineers are already using it!
otherInclude Go version in build info ()
otherUpdate go toolchain to v1.25.5 ()
otherNetdata Learn: Find documentation, guides, and reference material for monitoring and troubleshooting your systems with Netdata.
fixGitHub Issues: Make use of the Netdata repository to report bugs or open a new feature request.
otherGitHub Discussions: Join the conversation around the Netdata development process and be a part of it.
otherCommunity Forums: Visit the Community Forums and contribute to the collaborative knowledge base.
otherDiscord Server: Jump into the Netdata Discord and hang out with like-minded sysadmins, DevOps, SREs, and other troubleshooters. More than 2000 engineers are already using it!
fixFixed the go.d AP collector to handle unknown station statistics gracefully ()
fixFixed incorrect plugin and binary paths on Windows for the go.d plugin by correctly detecting the installation prefix at startup ()
otherImproved go.d job management by avoiding blocking during job shutdown, keeping other jobs responsive ()
fixFixed and standardized Windows AD, ADCS, and ADFS charts, and improved stability and accuracy of Windows hardware metrics collection ()
fixFixed SNMP service discovery by accepting version “2” and using the default polling interval instead of overriding it ()
otherLogged data collection duration when go.d collections are skipped due to a previous run still in progress ()
fixFixed the MSSQL errors chart in the Windows plugin by using the correct metric ()
breakingRemoved the strict rabbitmq_version check to improve RabbitMQ collector compatibility with older brokers ()
featureAdded collection statistics to the SNMP go.d collector and exposed them as per-profile charts ()
otherUpdated ndexec runner to return captured stdout on command failures ()
otherDisabled the MongoDB exporter on affected Ubuntu versions due to insecure libbson dependencies ()
otherUpdated bundled components used in static builds ()
fixFixed off-by-one validation in Journal v2 by treating extent_index == extent_entries as invalid, preventing out-of-bounds access ()
fixFixed timed waits in completion to handle spurious wakeups and honor shutdown timeouts, preventing premature timeouts and hangs ()
otherPrevented datafiles from exceeding their max size by making size checks atomic and accounting for incoming writes ()
otherUpdated DEB package builds to use XZ or zstd compression instead of gzip ()
otherNetdata Learn: Find documentation, guides, and reference material for monitoring and troubleshooting your systems with Netdata.
fixGitHub Issues: Make use of the Netdata repository to report bugs or open a new feature request.
otherGitHub Discussions: Join the conversation around the Netdata development process and be a part of it.
otherCommunity Forums: Visit the Community Forums and contribute to the collaborative knowledge base.
otherDiscord Server: Jump into the Netdata Discord and hang out with like-minded sysadmins, DevOps, SREs, and other troubleshooters. More than 2000 engineers are already using it!
otherAdjusted Windows sensors initialization by moving COM and Sensor API setup into the sensors thread for better stability ()
otherReplaced dots with slashes in OTEL metric families to enable hierarchical grouping in dashboards ()
fixFixed user group updates to ensure proper Proxmox group assignment in Docker entrypoint ()
otherEnsured Netdata has access to NVIDIA device files by adding the netdata user to the appropriate group, fixing GPU monitoring on non-Debian systems ()
otherPrevented replication from stalling by detecting empty-response loops and safely completing the process ()
otherStopped replication when the parent is already caught up, preventing stalls and unnecessary gap-filling ()
otherPrioritized environment-provided config directories in go.d for runtime overrides ()
otherSilenced Redis client library logs in the go.d Redis collector to reduce noise ()
otherNetdata Learn: Find documentation, guides, and reference material for monitoring and troubleshooting your systems with Netdata.
fixGitHub Issues: Make use of the Netdata repository to report bugs or open a new feature request.
otherGitHub Discussions: Join the conversation around the Netdata development process and be a part of it.
otherCommunity Forums: Visit the Community Forums and contribute to the collaborative knowledge base.
otherDiscord Server: Jump into the Netdata Discord and hang out with like-minded sysadmins, DevOps, SREs, and other troubleshooters. More than 2000 engineers are already using it!