CVE-2026-59785: 
Zabbix Server vulnerability analysis and mitigation

CVE-2026-59785 is an information disclosure vulnerability in the Zabbix Frontend that allows authenticated users with read access to infer stored IPMI and PSK credentials through a search result oracle attack. The host search functionality permits filtering by fields that are not displayed in the UI — including sensitive credential fields — enabling an attacker to guess a credential value and confirm its correctness based on whether matching results are returned. Affected versions include Zabbix 6.0.0–6.0.47, 7.0.0–7.0.28, and 7.4.0–7.4.12. It was published on October 5, 2026, and carries a CVSS v4.0 base score of 5.1 (Medium) (Zabbix Advisory, Github Advisory).

The root cause is classified as CWE-204 (Observable Response Discrepancy): the Zabbix Frontend's multiselect.get API endpoint allows filtering host records by credential fields (IPMI password, PSK key) that are intentionally hidden from the display layer, but the presence or absence of results in the response reveals whether a guessed value matches the stored credential. An authenticated attacker with at minimum host read access can craft repeated search queries with candidate credential values and use the binary search result feedback to enumerate the correct credential through a brute-force or dictionary approach. No special configuration or elevated privileges beyond standard read access are required (Zabbix Advisory, Github Advisory).

Successful exploitation allows an authenticated low-privileged user to systematically recover stored IPMI passwords and PSK (Pre-Shared Key) credentials associated with monitored hosts. Disclosure of IPMI credentials could enable an attacker to gain out-of-band management access to physical servers, while PSK credential exposure could compromise encrypted Zabbix agent communications. There is no integrity or availability impact; the vulnerability is limited to confidentiality of stored credential data (Zabbix Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires an authenticated session with at least host read access, and exploitation is not automatable at scale due to the adjacent network attack vector requirement. The EPSS score is approximately 0.158% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. It was reported to Zabbix via the HackerOne bug bounty platform by researcher Deniz Mert (Zabbix Advisory).

1. Authenticate: Log in to the Zabbix Frontend with any account that has read access to host objects.
2. Identify the target endpoint: Locate the multiselect.get API or equivalent host search functionality used by the Frontend for host filtering.
3. Craft a filtered search request: Send a search/filter request that includes a credential field (e.g., IPMI password or PSK key) as a filter parameter with a guessed value, even though this field is not rendered in the UI.
4. Observe the response: If the search returns one or more matching host records, the guessed credential value is correct; an empty result set indicates an incorrect guess.
5. Iterate: Repeat with different candidate values (dictionary attack or character-by-character brute force) to progressively narrow down and recover the full credential.
6. Use recovered credentials: Leverage the disclosed IPMI password for out-of-band server management access, or use the PSK key to decrypt or impersonate Zabbix agent communications (Zabbix Advisory, Github Advisory).

• Logs: Zabbix Frontend access logs showing a high volume of repeated host search or multiselect.get API requests from a single authenticated user session, particularly with varying filter parameter values targeting credential fields.
• Logs: Unusual search query patterns where filter parameters include fields not normally exposed in the UI (e.g., IPMI password, PSK fields).
• Network: Anomalous frequency of search API calls from a single source IP to the Zabbix Frontend, especially during off-hours.
• Application: Audit log entries (if enabled) showing repeated host lookup operations by a low-privileged user account in a short time window.

Zabbix has released patched versions that address this vulnerability: 6.0.48, 7.0.29, and 7.4.13. Users should upgrade to the respective fixed version for their branch as the primary remediation. No official workarounds are provided by the vendor. As a defense-in-depth measure, administrators should restrict read access to sensitive host configuration data where possible and monitor for unusual search patterns that may indicate credential enumeration attempts (Zabbix Advisory, Github Advisory).

The vulnerability was reported through Zabbix's HackerOne bug bounty program by researcher Deniz Mert, and Zabbix acknowledged and credited the researcher in their official advisory (Zabbix Advisory). Red Hat has tracked the issue via Bugzilla as a medium-severity security response item (Red Hat Bugzilla). No significant broader community or social media discussion has been observed at this time.