CVE-2026-23919

MediumCVSS 6.0/10Last modified Sep 18, 2026

Description

For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-488

Affected software

No affected versions have been published.

Timeline

Published: Mar 24, 2026
Last modified: Sep 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-239208.8Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and CVE-2026-239218.8A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execut CVE-2026-239224.9The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoin CVE-2026-239235.3An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on e CVE-2026-239244.9Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An CVE-2026-239258.1An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. Th CVE-2026-239266.8An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens CVE-2026-239276.5A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connectin CVE-2026-239286.8The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabl CVE-2026-239295.4Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filteri CVE-2026-23937.1A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/ser CVE-2026-239307.5An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the