CVE-2025-27231: Zabbix LDAP Password Disclosure Vulnerability

CVE-2025-27231 Overview

CVE-2025-27231 is a credential exposure vulnerability in Zabbix that allows a Super Admin account to leak the stored Lightweight Directory Access Protocol (LDAP) Bind password. The password field is write-only in the user interface and cannot be read after being saved. However, an attacker with Super Admin privileges can point the LDAP Host field to a rogue LDAP server they control and trigger a bind attempt, causing Zabbix to transmit the stored bind credentials to the attacker's server. The issue is tracked under CWE-522: Insufficiently Protected Credentials. Zabbix has addressed the flaw by resetting the Bind password value whenever the Host field is changed.

Critical Impact
A Super Admin can exfiltrate the plaintext LDAP bind credential to an attacker-controlled directory server, enabling lateral movement into the corporate identity infrastructure.

Affected Products

Zabbix (multiple versions per vendor advisory)
Zabbix frontend LDAP authentication configuration
Deployments using LDAP as an authentication backend

Discovery Timeline

2025-10-03 - CVE-2025-27231 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27231

Vulnerability Analysis

Zabbix supports LDAP as an external authentication source. Administrators configure a Bind Distinguished Name (DN) and Bind password that the Zabbix server uses to query the directory for user lookups. The frontend intentionally hides the stored password so operators cannot read it back after configuration. This control assumes that no legitimate workflow needs to display the secret again.

The flaw is a business logic and credential protection failure. Zabbix continues to use the stored password regardless of which LDAP Host value is currently configured. A Super Admin can modify only the Host field, redirect authentication traffic to an arbitrary server, and trigger a test bind. The stored password is then submitted in cleartext to the attacker's LDAP endpoint.

The attack requires an authenticated Super Admin account and network reachability from the Zabbix host to an attacker-controlled LDAP server. Because the credential frequently maps to a service account with directory read access, disclosure can enable enumeration of Active Directory or OpenLDAP objects and downstream lateral movement.

Root Cause

The root cause is a missing invariant between the Host and Bind password configuration fields. Zabbix treats the credential as bound to the LDAP configuration record rather than to a specific, verified server identity. Because no revalidation is required when the target host changes, the trust boundary of the stored secret expands to any host a Super Admin can specify.

Attack Vector

An attacker who has compromised or holds a Super Admin session performs the following steps. First, they stand up a rogue LDAP responder such as a modified slapd instance or a script that logs bind requests. Second, they edit the LDAP authentication settings in Zabbix and replace the Host value with their listener. Third, they invoke the LDAP test or trigger any authentication flow that causes Zabbix to bind. The rogue server receives the bind DN and cleartext password and records them.

The vulnerability is exploitable over an adjacent network path from the Zabbix server to the attacker-controlled listener. It does not require user interaction beyond the attacker's own administrative actions. Refer to the Zabbix issue tracker ZBX-27062 for vendor technical details.

Detection Methods for CVE-2025-27231

Indicators of Compromise

Zabbix audit log entries showing modifications to the LDAP Host field followed by a test authentication attempt.
Outbound LDAP or LDAPS connections from the Zabbix server to unfamiliar external or non-corporate IP addresses.
Unexpected bind attempts recorded on directory servers that were not previously authorized as Zabbix targets.
Super Admin session activity originating from unusual source addresses or outside change-management windows.

Detection Strategies

Monitor the Zabbix auditlog table for UPDATE actions on userdirectory or LDAP configuration records and correlate with authentication test events.
Alert on TCP connections from Zabbix frontend or server hosts to destination ports 389 or 636 that do not match an approved directory allowlist.
Compare current LDAP configuration values against a known-good baseline and alert on drift, especially in the Host field.

Monitoring Recommendations

Forward Zabbix audit logs to a centralized logging or SIEM platform for retention and correlation.
Enable directory server logging for failed and successful binds and review sources that deviate from expected service accounts.
Track Super Admin account usage and enforce alerting for privileged configuration changes.

How to Mitigate CVE-2025-27231

Immediate Actions Required

Upgrade Zabbix to a version that includes the fix that resets the Bind password when the LDAP Host field is changed.
Rotate the current LDAP bind account password and any credentials that share it, then update Zabbix with the new value.
Audit the Super Admin role membership and remove accounts that do not require this privilege level.
Review historical audit logs for prior modifications to the LDAP Host field and investigate any anomalies.

Patch Information

Zabbix has released updated builds that reset the stored Bind password when the Host field is modified. Consult the Zabbix issue tracker ZBX-27062 for fixed version numbers and upgrade instructions. Apply the patch across all Zabbix frontend and server instances that use LDAP authentication.

Workarounds

Restrict outbound network egress from Zabbix hosts to only approved LDAP directory servers using host or perimeter firewall rules.
Enforce LDAPS with strict certificate validation so a rogue server without a trusted certificate is rejected during the bind.
Limit Super Admin accounts to a small number of named individuals and require multi-factor authentication for those accounts.
Implement change control that requires peer review before any modification to LDAP authentication settings.

bash

# Example: restrict Zabbix server egress to a specific LDAP directory host
# Replace 10.10.5.20 with your authorized directory server IP
iptables -A OUTPUT -p tcp -d 10.10.5.20 --dport 636 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 389 -j DROP
iptables -A OUTPUT -p tcp --dport 636 -j DROP