# CVE-2024-32019

Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability.

- Page: https://www.vulneraibility.com/cve/CVE-2024-32019
- CVSS: 8.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 1.17% (percentile 67.7)
- Public exploit code: 1 Metasploit module · 12 GitHub proofs of concept (first 2025-08-03)
- CISA SSVC: exploitation poc, automatable no, technical impact total (assessed 2024-08-20)
- Weakness: CWE-426
- Published: 2024-04-12

## Affected versions

- netdata: affected >= 1.45.0 and < 1.45.3; >= 1.44.0-60 and < 1.45.0-169

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93
- [other] https://github.com/netdata/netdata/pull/17377

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.