CVE-2026-23919
Information Disclosure in Zabbix JavaScript Context Reuse
Publication date: 2026-03-24
Last updated on: 2026-03-24
Assigner: Zabbix
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zabbix | zabbix_server | * |
| zabbix | zabbix_proxy | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-488 | The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Zabbix Server and Proxy where JavaScript (Duktape) contexts are reused for performance reasons. These contexts are used in script items, JavaScript reprocessing, and Webhooks.
Because of this reuse, a regular (non-super) Zabbix administrator can potentially leak data from hosts they do not have access to, leading to confidentiality loss.
A fix has been released that makes the built-in Zabbix JavaScript objects read-only to mitigate this issue, but the use of global JavaScript variables is still not recommended as their content could be leaked.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized data disclosure where a regular Zabbix administrator might access confidential information from hosts they are not authorized to view.
Such confidentiality loss can compromise sensitive information within your monitoring environment, potentially exposing critical data to unauthorized personnel.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, apply the fix released by Zabbix that makes the built-in Zabbix JavaScript objects read-only.
Additionally, avoid using global JavaScript variables in Zabbix scripts, as their content could be leaked due to the reuse of JavaScript contexts.
For more detailed information, refer to the Zabbix documentation on known issues related to preprocessing and global variables.