CVE-2026-1199: Zabbix API Authentication Bypass Vulnerability

CVE-2026-1199 Overview

CVE-2026-1199 is a race condition vulnerability in the Zabbix API and Frontend login lockout mechanism. The flaw prevents the block counter from correctly tallying concurrent unsuccessful login attempts. Attackers who submit multiple authentication requests simultaneously can exceed the intended failed-attempt threshold before the lockout activates. This weakens brute-force protections and expands the effective password guess budget available to unauthenticated attackers over the network.

Critical Impact
Concurrent login requests bypass the lockout counter, enabling attackers to attempt more password guesses than the configured policy permits against Zabbix accounts.

Affected Products

Zabbix API
Zabbix Frontend
Refer to Zabbix Issue ZBX-28076 for affected version details

Discovery Timeline

2026-08-18 - CVE-2026-1199 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-1199

Vulnerability Analysis

The vulnerability is classified as a race condition [CWE-362] affecting the authentication lockout logic in the Zabbix API and web Frontend. Zabbix enforces a block counter that increments on failed login attempts and locks the account or source after crossing a configured threshold. When multiple failed authentication requests arrive concurrently, the increment operation is not properly synchronized. Several requests read the counter, evaluate the threshold, and process the attempt before any of them commits an updated value.

This behavior allows an attacker to submit a burst of parallel login attempts and have most of them counted as a single failure toward the lockout policy. The result is that more password guesses succeed in reaching the credential validation path than the administrator intended. Over repeated bursts, this materially increases the success probability of an online brute-force or credential-stuffing attack against Zabbix accounts, including administrative ones exposed over the network.

Root Cause

The root cause is a Time-of-Check to Time-of-Use (TOCTOU) condition in the failed-attempt accounting path. The lockout check and counter update are not executed as an atomic operation, and there is no locking or transactional guarantee between concurrent authentication handlers evaluating the same account.

Attack Vector

Exploitation requires no authentication, no user interaction, and network access to the Zabbix Frontend or API endpoint. An attacker sends parallel HTTP POST requests to the login endpoint with candidate credentials. The number of guesses effectively evaluated per lockout window scales with request concurrency rather than the administrator's configured attempt limit.

No verified proof-of-concept code is available. See the Zabbix Issue ZBX-28076 tracker for vendor technical details.

Detection Methods for CVE-2026-1199

Indicators of Compromise

Bursts of near-simultaneous POST requests to Zabbix login endpoints such as index.php or api_jsonrpc.php from a single source or distributed set of sources
Repeated Login failed events in the Zabbix audit log for the same username within sub-second intervals
Successful authentications from source addresses that previously generated high volumes of failed attempts without triggering a lockout

Detection Strategies

Aggregate Zabbix audit log entries by username and source IP over short time windows to identify concurrent failed-login clusters that exceed the configured threshold
Alert when the count of failed logins per user within a one-second window exceeds a small baseline, which indicates parallel request submission
Correlate web server access logs with authentication outcomes to surface requests that arrived faster than sequential human input allows

Monitoring Recommendations

Forward Zabbix Frontend, API, and web server logs to a centralized analytics platform and retain them for brute-force pattern analysis
Monitor upstream reverse proxies and web application firewalls for rate anomalies against /index.php and /api_jsonrpc.php
Track successful logins that occur shortly after a failed-attempt burst and flag them for review

How to Mitigate CVE-2026-1199

Immediate Actions Required

Apply the fixed Zabbix release once available; consult Zabbix Issue ZBX-28076 for patched version numbers
Restrict network exposure of the Zabbix Frontend and API to trusted management networks or VPN users
Enforce strong, unique passwords and enable multi-factor authentication for all Zabbix accounts, especially administrative ones
Rotate credentials for any accounts that show evidence of high-volume failed-login activity

Patch Information

Zabbix has tracked the issue as ZBX-28076. Administrators should review the Zabbix issue tracker entry for fixed versions and upgrade guidance. Until the patch is deployed, compensating controls at the network and reverse-proxy layer are required to blunt concurrent brute-force attempts.

Workarounds

Place Zabbix behind a reverse proxy or web application firewall that enforces per-source and per-user rate limits on login endpoints
Configure fail2ban or an equivalent tool against Zabbix web server logs to ban source IPs after a small number of failed attempts, independent of the application-level counter
Restrict access to api_jsonrpc.php and the login page using IP allow-lists at the proxy, firewall, or ingress layer
Reduce concurrent connections per source IP at the load balancer to limit parallel authentication requests

bash

# Example nginx rate limit for Zabbix login endpoints
# Place in the http { } block
limit_req_zone $binary_remote_addr zone=zabbix_login:10m rate=5r/m;

# Place inside the server { } block for the Zabbix vhost
location ~ ^/(index\.php|api_jsonrpc\.php)$ {
    limit_req zone=zabbix_login burst=5 nodelay;
    limit_conn_zone $binary_remote_addr zone=zabbix_conn:10m;
    limit_conn zabbix_conn 2;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}