CVE-2026-23920
HighSummary
Input validation for host and event action scripts in Zabbix uses regex (set by the administrator) but runs in multiline mode. If ^ and $ anchors are used, an injected newline lets authenticated users bypass the check and inject shell commands.
Risk Assessment
Risk of unauthorized shell command execution on the Zabbix server, potentially leading to full system compromise.
Recommendation
Update Zabbix to a patched version and adjust validation configuration to avoid multiline mode or use proper safeguards.
Other vulnerabilities in Zabbix
See all- CVE-2026-23938Low
An authenticated administrator can crash Zabbix server or proxy by creating specially crafted preprocessing/script item JavaScript scripts, leading to denial of service.
- CVE-2026-23937Medium
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key, leading to potential loss of data integrity.
- CVE-2026-23935Medium
A Zabbix administrator can read out-of-bounds memory by exploiting a flaw in the HttpRequest logic of script items/preprocessing (JavaScript), leading to potential confidentiality loss.
- CVE-2026-23934Medium
An authenticated user can cause disproportionate CPU load on the Frontend webserver by sending specially crafted requests to the validate.api.exists action, leading to potential denial of service.
- CVE-2026-23931Medium
The frontend validate.api.exists action can be exploited by authenticated users to extract plaintext user macro values, leading to potential loss of confidentiality.
- CVE-2026-23930Medium
An unauthenticated user can cause disproportionate CPU load on the Frontend webserver by sending specially crafted requests to the popup.testtriggerexpr action, leading to potential denial of service.
- CVE-2026-23922Low
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.
- CVE-2026-1199Medium
The login lockout mechanism in Zabbix API and Frontend has a flaw where several unsuccessful login requests sent simultaneously are not properly counted towards the block counter, potentially allowing more password guesses than intended.
- CVE-2026-23921High
A low-privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
- CVE-2026-23919High
For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts in script items, JavaScript reprocessing, and Webhooks. This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released making built-in Zabbix JavaScript objects read-only, but usage of global JavaScript variables is not recommended.
Original NVD description (English source)
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.