CVE-2026-23920

HighCVSS 8.8/10Last modified Sep 10, 2026

Description

Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2026
Last modified
Sep 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-239218.8A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to executCVE-2026-239224.9The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoinCVE-2026-239235.3An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on eCVE-2026-239244.9Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. AnCVE-2026-239258.1An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. ThCVE-2026-239266.8An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opensCVE-2026-239276.5A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connectinCVE-2026-239286.8The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enablCVE-2026-239295.4Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filteriCVE-2026-23937.1A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/serCVE-2026-239307.5An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to theCVE-2026-239314.3The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potentia