CVE-2026-83598

7.8 Élevée

Publiée le 22/09/2026 à 19:17 · Modifiée le 23/09/2026 à 20:28 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 from the low-privileged user who initiated repair. Commands placed in that profile before repair therefore execute with SYSTEM privileges. This vulnerability is fixed in 2.10.4.

Traduire en français

Produits concernés

netdata

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.8 Élevée	security-advisories@github.com	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-269
CWE-427

Références

https://github.com/netdata/netdata/commit/d762782697623a98b51b4e41f7fe2d12404f0662
https://github.com/netdata/netdata/pull/22751
https://github.com/netdata/netdata/releases/tag/v2.10.4
https://github.com/netdata/netdata/security/advisories/GHSA-8hxv-2mg6-ggw5
https://github.com/netdata/netdata/security/advisories/GHSA-8hxv-2mg6-ggw5

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories