Is CVE-2023-22496 actively exploited?

No active exploitation of CVE-2023-22496 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-22496 be exploited remotely?

Yes. CVE-2023-22496 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-22496?

CVE-2023-22496 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2023-22496

CRITICAL

CVE-2023-22496

CWE-20Published: January 14, 2023· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the function `health_alarm_execute` is called. This function performs different checks and then enqueues a command by calling `spawn_enq_cmd`. This command is populated with several arguments that are not sanitized. One of them is the `registry_hostname` of the node for which the alert is raised. By providing a specially crafted `registry_hostname` as part of the health data that is streamed to a Netdata (parent) agent, an attacker can execute arbitrary commands at the remote host as a side-effect of the raised alert. Note that the commands are executed as the user running the Netdata Agent. This user is usually named `netdata`. The ability to run arbitrary commands may allow an attacker to escalate privileges by escalating other vulnerabilities in the system, as that user. The problem has been fixed in: Netdata agent v1.37 (stable) and Netdata agent v1.36.0-409 (nightly). As a workaround, streaming is not enabled by default. If you have previously enabled this, it can be disabled. Limiting access to the port on the recipient Agent to trusted child connections may mitigate the impact of this vulnerability.

NVD Source

Risk Analysis

Netdata is vulnerable to remote command execution due to improper sanitization of the registry_hostname argument during health alert processing. An attacker can exploit this by establishing a streaming connection to a parent agent to execute arbitrary commands. The critical CVSS score of 9.8 reflects the high potential for full system compromise.

There is no known public exploit for this vulnerability, and it is not currently listed in CISA KEV. It is remotely exploitable with low attack complexity.

Recommended Action

Users should update to the latest version of Netdata to ensure command arguments are properly sanitized.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-22496 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.