PT-2026-27473 · Zabbix+1 · Zabbix+1

Big_John · Publicado 2026-03-24 · Atualizado 2026-04-17 · CVE-2026-23919

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Zabbix versions prior to 7.4

Description A design flaw in Zabbix Server/Proxy related to JavaScript (Duktape) context reuse can result in data leakage. Specifically, a regular Zabbix administrator may unintentionally expose data for hosts they are not authorized to access. The issue stems from the way JavaScript contexts are handled during script item processing, JavaScript reprocessing, and Webhooks. A fix has been implemented to make built-in Zabbix JavaScript objects read-only, but the use of global JavaScript variables is discouraged as their content could still be exposed.

Recommendations Update to Zabbix version 7.4 or later. Avoid using global JavaScript variables.

Correção

Enumeração de Fraquezas

CWE-488

Identificadores relacionados

BDU:2026-07354

CVE-2026-23919

Produtos afetados

Red Os

Zabbix

Referências · 18

• https://security-tracker.debian.org/tracker/CVE-2026-23919 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23919 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-zabbix-lts-cve-2026-23919-8.0 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-zabbix7-lts-cve-2026-23919-7.3 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-zabbix7-4-cve-2026-23919-7.3 · Nota
• https://cve.org/CVERecord?id=CVE-2026-23919 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-23919 · Nota de Segurança
• https://twitter.com/autumn_good_35/status/2037538031234941217 · Publicação no Twitter
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-zabbix7-2-cve-2026-23919-7.3 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-zabbix-lts-cve-2026-23919-7.3 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23919 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-23919 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-07354 · Nota de Segurança
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-zabbix7-lts-cve-2026-23919-8.0 · Nota
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-23919 · Nota