CVE-2026-23919

Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server

State: Published
Severity: 7.1 High
Published: Mar 24, 2026
Updated: Apr 22, 2026
Reserved: Jan 19, 2026

Description

For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L	Zabbix

Weaknesses

CWE-488 Exposure of Data Element to Wrong Session

Affected Products

Product	Versions
ZabbixZabbix	6.0.0 through 6.0.41Affectedfrom 6.0.42Not affected 7.0.0 through 7.0.18Affectedfrom 7.0.19Not affected 7.2.0 through 7.2.12Affectedfrom 7.2.13Not affected 7.4.0 through 7.4.2Affectedfrom 7.4.3Not affected

References

https://support.zabbix.com/browse/ZBX-27638

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.