CVE-2026-23919: 
Zabbix Server vulnerability analysis and mitigation

CVE-2026-23919 is an insufficient JavaScript execution context isolation vulnerability in Zabbix Server and Proxy, classified as "Insufficient isolation of JavaScript (Duktape) execution context." For performance reasons, Zabbix reuses Duktape JavaScript contexts across script items, JavaScript preprocessing, and Webhooks, enabling a regular (non-super) administrator to leak confidential data from hosts they are not authorized to access. Affected versions include Zabbix 6.0.0–6.0.41, 7.0.0–7.0.18, 7.2.0–7.2.12, and 7.4.0–7.4.2. It was disclosed on March 24, 2026, and carries a CVSS v4.0 base score of 7.1 (High) (Zabbix Jira, Red Hat Advisory).

The root cause is improper isolation or compartmentalization (CWE-653) combined with exposure of data elements to the wrong session (CWE-488). Zabbix Server and Proxy reuse Duktape JavaScript engine contexts across multiple execution requests — including script items, preprocessing scripts, and webhook handlers — without resetting shared state between executions. A regular (non-super) Zabbix administrator can exploit this by overwriting built-in JavaScript functions that are subsequently executed in the context of other objects, or by reading global JavaScript variables that retain data from prior executions belonging to hosts outside their access scope. The attack requires adjacent network access, high privileges (regular admin), and specific preconditions (AT:P), limiting but not eliminating exploitability (Zabbix Jira, Red Hat Bugzilla).

Successful exploitation allows a non-super Zabbix administrator to access and exfiltrate sensitive monitoring data — such as host configurations, credentials stored in scripts, or metric values — belonging to hosts outside their assigned administrative scope. This constitutes a confidentiality breach and a form of privilege escalation within the Zabbix platform. Integrity and availability impacts are low, but the high confidentiality impact on both vulnerable and subsequent system components (SC:H, VC:H) means sensitive infrastructure data could be exposed, potentially enabling further lateral movement if credentials or network topology details are leaked (Zabbix Jira, Feedly).

1. Gain Regular Admin Access: Obtain or compromise a regular (non-super) Zabbix administrator account on a target Zabbix Server or Proxy instance running an affected version (6.0.0–6.0.41, 7.0.0–7.0.18, 7.2.0–7.2.12, or 7.4.0–7.4.2).
2. Identify JavaScript Execution Points: Navigate to Zabbix's script items, JavaScript preprocessing rules, or webhook configurations — all of which use the shared Duktape JavaScript context.
3. Overwrite Built-in JavaScript Functions: Craft a malicious JavaScript script that overwrites a built-in Zabbix JavaScript function (e.g., a commonly invoked utility function). When this function is subsequently called during processing of another host's data, the attacker-controlled code executes in that context.
4. Read Global Variables: Alternatively, craft a script that reads global JavaScript variables (e.g., this.<variable> or globally scoped variables) that may have been populated by prior executions belonging to hosts outside the attacker's access scope.
5. Exfiltrate Data: Capture the leaked data (host configurations, credentials, metric values) by logging it to an attacker-controlled endpoint via an HTTP request within the JavaScript context, or by storing it in a location accessible to the attacker within Zabbix (Zabbix Jira).

• Logs: Zabbix server logs showing unexpected JavaScript execution errors or unusual function overwrites in preprocessing or webhook scripts; audit logs recording modifications to script items or webhook configurations by non-super administrator accounts.
• Configuration: Presence of unusual or obfuscated JavaScript code in script items, preprocessing scripts, or webhook definitions — particularly code that reads global variables or redefines built-in functions.
• Network: Unexpected outbound HTTP requests originating from the Zabbix server process to external or unauthorized endpoints, potentially carrying exfiltrated host data in request bodies or parameters.
• Process Behavior: Zabbix server or proxy processes making anomalous external connections not consistent with configured monitoring targets or webhook destinations (Zabbix Jira).

Zabbix has released fixed versions addressing this vulnerability: 6.0.42, 7.0.19, 7.2.13, and 7.4.3. The fix makes built-in Zabbix JavaScript objects read-only, preventing overwriting of built-in functions. However, Zabbix explicitly warns that global JavaScript variables remain unsafe and their content could still be leaked through context reuse — administrators should ensure preprocessing scripts do not store sensitive or secret data in global variables. As an operational best practice, restrict JavaScript execution features (script items, preprocessing, webhooks) to only fully trusted administrators, and audit existing scripts for use of global variables (Zabbix Jira, Red Hat Advisory).

The vulnerability was reported via HackerOne's bug bounty program by researcher Yerdan (big_john), and Zabbix acknowledged and credited the researcher in their official bug tracker. Red Hat tracked the issue in their Bugzilla system with high severity, indicating downstream impact awareness for distributions shipping Zabbix packages. Weekly threat landscape digests (Hawk-Eye) included this CVE in their coverage for weeks 14 and 15 of 2026, suggesting moderate community awareness. No significant broader media coverage or notable researcher commentary beyond the official disclosure has been identified (Zabbix Jira, Red Hat Bugzilla).