CVE-2026-23919

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23919", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "state": "PUBLISHED", "assignerShortName": "Zabbix", "dateReserved": "2026-01-19T14:02:54.327Z", "datePublished": "2026-03-24T18:26:43.877Z", "dateUpdated": "2026-04-22T07:06:32.148Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2026-04-22T07:06:32.148Z"}, "title": "Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-488", "description": "CWE-488: Exposure of Data Element to Wrong Session", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-124", "descriptions": [{"lang": "en", "value": "CAPEC-124: Shared Resource Manipulation"}]}], "affected": [{"vendor": "Zabbix", "product": "Zabbix", "repo": "https://git.zabbix.com/", "modules": ["Server", "Proxy"], "versions": [{"status": "affected", "version": "6.0.0", "lessThanOrEqual": "6.0.41", "changes": [{"at": "6.0.42", "status": "unaffected"}], "versionType": "git"}, {"status": "affected", "version": "7.0.0", "lessThanOrEqual": "7.0.18", "changes": [{"at": "7.0.19", "status": "unaffected"}], "versionType": "git"}, {"status": "affected", "version": "7.2.0", "lessThanOrEqual": "7.2.12", "changes": [{"at": "7.2.13", "status": "unaffected"}], "versionType": "git"}, {"status": "affected", "version": "7.4.0", "lessThanOrEqual": "7.4.2", "changes": [{"at": "7.4.3", "status": "unaffected"}], "versionType": "git"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information &lt;a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'&gt;in Zabbix documentation&lt;/a&gt;.</p>"}]}], "references": [{"url": "https://support.zabbix.com/browse/ZBX-27638"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L"}}], "configurations": [{"lang": "en", "value": "A regular Zabbix administrator (non-super) can overwrite some built in JavaScript functions that are then executed for other objects. Alternatively, a regular Zabbix administrator can read global JavaScript variables.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A regular Zabbix administrator (non-super) can overwrite some built in JavaScript functions that are then executed for other objects. Alternatively, a regular Zabbix administrator can read global JavaScript variables.</p>"}]}], "solutions": [{"lang": "en", "value": "Update the affected components to their respective fixed versions. Make sure JavaScript item preprocessing scripts don't store secret data in global variables.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Update the affected components to their respective fixed versions. Make sure JavaScript item preprocessing scripts don't store secret data in global variables.</p>"}]}], "credits": [{"lang": "en", "value": "Zabbix wants to thank Yerdan (big_john) for submitting this report on the HackerOne bug bounty platform.", "type": "reporter"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T18:36:08.999862Z", "id": "CVE-2026-23919", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T18:36:16.860Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23919", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T18:36:08.999862Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T18:36:13.549Z"}}], "cna": {"title": "Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank Yerdan (big_john) for submitting this report on the HackerOne bug bounty platform."}], "impacts": [{"capecId": "CAPEC-124", "descriptions": [{"lang": "en", "value": "CAPEC-124: Shared Resource Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.zabbix.com/", "vendor": "Zabbix", "modules": ["Server", "Proxy"], "product": "Zabbix", "versions": [{"status": "affected", "changes": [{"at": "6.0.42", "status": "unaffected"}], "version": "6.0.0", "versionType": "git", "lessThanOrEqual": "6.0.41"}, {"status": "affected", "changes": [{"at": "7.0.19", "status": "unaffected"}], "version": "7.0.0", "versionType": "git", "lessThanOrEqual": "7.0.18"}, {"status": "affected", "changes": [{"at": "7.2.13", "status": "unaffected"}], "version": "7.2.0", "versionType": "git", "lessThanOrEqual": "7.2.12"}, {"status": "affected", "changes": [{"at": "7.4.3", "status": "unaffected"}], "version": "7.4.0", "versionType": "git", "lessThanOrEqual": "7.4.2"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Update the affected components to their respective fixed versions. Make sure JavaScript item preprocessing scripts don't store secret data in global variables.", "supportingMedia": [{"type": "text/html", "value": "<p>Update the affected components to their respective fixed versions. Make sure JavaScript item preprocessing scripts don't store secret data in global variables.</p>", "base64": false}]}], "references": [{"url": "https://support.zabbix.com/browse/ZBX-27638"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.", "supportingMedia": [{"type": "text/html", "value": "<p>For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information &lt;a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'&gt;in Zabbix documentation&lt;/a&gt;.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-488", "description": "CWE-488: Exposure of Data Element to Wrong Session"}]}], "configurations": [{"lang": "en", "value": "A regular Zabbix administrator (non-super) can overwrite some built in JavaScript functions that are then executed for other objects. Alternatively, a regular Zabbix administrator can read global JavaScript variables.", "supportingMedia": [{"type": "text/html", "value": "<p>A regular Zabbix administrator (non-super) can overwrite some built in JavaScript functions that are then executed for other objects. Alternatively, a regular Zabbix administrator can read global JavaScript variables.</p>", "base64": false}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2026-04-22T07:06:32.148Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23919", "state": "PUBLISHED", "dateUpdated": "2026-04-22T07:06:32.148Z", "dateReserved": "2026-01-19T14:02:54.327Z", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "datePublished": "2026-03-24T18:26:43.877Z", "assignerShortName": "Zabbix"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["Server", "Proxy"], "product": "Zabbix", "repo": "https://git.zabbix.com/", "vendor": "Zabbix", "versions": [{"changes": [{"at": "6.0.42", "status": "unaffected"}], "lessThanOrEqual": "6.0.41", "status": "affected", "version": "6.0.0", "versionType": "git"}, {"changes": [{"at": "7.0.19", "status": "unaffected"}], "lessThanOrEqual": "7.0.18", "status": "affected", "version": "7.0.0", "versionType": "git"}, {"changes": [{"at": "7.2.13", "status": "unaffected"}], "lessThanOrEqual": "7.2.12", "status": "affected", "version": "7.2.0", "versionType": "git"}, {"changes": [{"at": "7.4.3", "status": "unaffected"}], "lessThanOrEqual": "7.4.2", "status": "affected", "version": "7.4.0", "versionType": "git"}]}], "source": "security@zabbix.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2064EB0-0043-419C-8255-68AAC48B0CEA", "versionEndExcluding": "6.0.42", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF2BC8B0-51C4-46B0-8FD1-28646E7206A2", "versionEndExcluding": "7.0.19", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "E3152979-951B-45B6-8FE1-58145CEE20DB", "versionEndExcluding": "7.2.13", "versionStartIncluding": "7.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "06D593F3-9EFF-4D71-97D2-3B316AFCC782", "versionEndExcluding": "7.4.3", "versionStartIncluding": "7.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>."}, {"lang": "es", "value": "Por razones de rendimiento, Zabbix Server/Proxy reutiliza contextos de JavaScript (Duktape) (utilizados en elementos de script, reprocesamiento de JavaScript, Webhooks). Esto puede llevar a una p\u00e9rdida de confidencialidad donde un administrador de Zabbix regular (no-super) filtra datos de hosts a los que no tiene acceso. Se ha lanzado una correcci\u00f3n que hace que los objetos JavaScript integrados de Zabbix sean de solo lectura, pero tenga en cuenta que el uso de variables globales de JavaScript no est\u00e1 recomendado porque su contenido podr\u00eda ser filtrado. M\u00e1s informaci\u00f3n <a href=\"https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe\" rel=\"nofollow\">en la documentaci\u00f3n de Zabbix</a>."}], "id": "CVE-2026-23919", "lastModified": "2026-09-18T17:07:18.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@zabbix.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23919", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T18:36:08.999862Z", "version": "2.0.3"}}]}, "published": "2026-03-24T19:16:49.290", "references": [{"source": "security@zabbix.com", "tags": ["Vendor Advisory"], "url": "https://support.zabbix.com/browse/ZBX-27638"}], "sourceIdentifier": "security@zabbix.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-488"}], "source": "security@zabbix.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.0.40]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.0.18]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.0,7.2.12]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.0,7.4.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Zabbix", "source": "cna", "vendor": "Zabbix"}, "product": "zabbix", "vendor": "zabbix"}], "analysis": {"en": {"generated_at": "2026-03-24T19:20:39.514466+00:00", "value": {"mitigation_remediation": ["Update the Zabbix Server and Proxy components to the fixed versions that enforce read\u2011only built\u2011in JavaScript objects", "Review existing JavaScript preprocessing scripts and remove any use of global variables that could store sensitive data", "Verify that non\u2011super administrators can no longer access host data they are not authorized to view", "Continuously monitor script changes to prevent accidental reintroduction of vulnerable code"], "summary": {"action": "Immediate Patch", "impact": "Confidentiality loss due to JavaScript data leakage"}, "threat_synthesis": {"affected_systems": "All Zabbix Server and Proxy installations that employ the default Duktape context reuse are impacted. Any instance that has not applied the patch that enforces read\u2011only built\u2011in JavaScript objects remains vulnerable, regardless of major release.", "description_and_impact": "The vulnerability arises from the reuse of JavaScript (Duktape) execution contexts in Zabbix Server and Proxy, allowing a non\u2011super administrator to craft or trigger scripts that read data from hosts they normally cannot access. This leads to the disclosure of sensitive configuration or credentials, impairing confidentiality. The weakness is identified as CWE\u2011488, reflecting improper isolation of execution contexts.", "risk_and_exploitability": "With a CVSS score of 7.1 the flaw is of medium to high severity, yet it is not listed in the CISA Known Exploited Vulnerabilities catalog and EPSS information is unavailable. The attack vector is local; an attacker can exploit the issue by creating or editing JavaScript preprocessing scripts, a capability granted to regular administrators. The resulting harm is confined to information disclosure, but can be significant if confidential data is exposed."}}}}, "created": "2026-03-25T11:46:39.911686+00:00", "updated": "2026-03-25T20:49:24.904562+00:00", "vendors": ["zabbix", "zabbix$PRODUCT$zabbix"]}