CVE-2026-23921: Zabbix API SQL Injection Vulnerability

CVE-2026-23921 Overview

A blind SQL injection vulnerability exists in Zabbix's API service component located in include/classes/api/CApiService.php. A low privilege Zabbix user with API access can exploit this vulnerability by manipulating the sortfield parameter to execute arbitrary SQL SELECT statements. Although query results are not returned directly to the attacker, data can be exfiltrated through time-based inference techniques, potentially leading to session identifier disclosure and full administrator account compromise.

Critical Impact

Attackers with low-privilege API access can exfiltrate sensitive database information including session tokens, enabling complete administrator account takeover through time-based blind SQL injection techniques.

Affected Products

• Zabbix installations with API access enabled
• Systems with low-privilege users granted API permissions
• Zabbix versions containing the vulnerable CApiService.php component

Discovery Timeline

• 2026-03-24 - CVE-2026-23921 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23921

Vulnerability Analysis

This vulnerability falls under CWE-89 (SQL Injection), a critical class of web application security flaws where user-supplied input is improperly incorporated into SQL queries. The vulnerable code path resides within Zabbix's API service layer, specifically in the CApiService.php file that handles API request processing.

The vulnerability is network-accessible, meaning remote attackers can exploit it without requiring physical or local access to the target system. The attack complexity is low, as exploitation does not require specialized conditions or complex manipulation. While low-privilege credentials are required, the barrier to entry remains minimal in environments where API access is commonly granted to monitoring personnel or automated systems.

Successful exploitation can result in complete compromise of data confidentiality, integrity, and availability within the Zabbix database. The attacker can extract sensitive information including user credentials, session tokens, configuration data, and monitoring information stored in the database.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization of the sortfield parameter within the CApiService.php file. The API endpoint fails to properly parameterize or escape user-supplied sorting field values before incorporating them into dynamically constructed SQL queries. This allows attackers to inject arbitrary SQL syntax that gets executed by the database engine.

When the API constructs ORDER BY clauses using the unsanitized sortfield parameter, attackers can append SQL injection payloads that alter the query's behavior. The lack of prepared statements or proper input whitelisting for sorting field names creates this exploitable condition.

Attack Vector

The attack leverages the Zabbix API's sorting functionality accessible to authenticated low-privilege users. An attacker crafts malicious API requests containing SQL injection payloads within the sortfield parameter. Since this is a blind SQL injection vulnerability, the attacker cannot directly observe query results in API responses.

Instead, attackers employ time-based inference techniques where conditional SQL statements cause measurable delays in server response times. By systematically injecting payloads that trigger delays based on data conditions (such as character comparisons), attackers can extract database contents byte-by-byte. This technique is commonly used to exfiltrate session identifiers, which can then be used to hijack administrator accounts.

The attack requires valid API credentials for a low-privilege Zabbix user, making it an authenticated attack vector. However, in many enterprise deployments, API access is granted to numerous monitoring accounts, expanding the potential attack surface.

Detection Methods for CVE-2026-23921

Indicators of Compromise

• Unusual API requests containing SQL syntax characters (single quotes, semicolons, UNION, SLEEP, BENCHMARK, WAITFOR) in sortfield parameters
• High volumes of API requests from single users with slight parameter variations indicating automated exploitation
• Abnormally slow API response times that may indicate time-based injection testing
• Database query logs showing malformed or suspicious ORDER BY clauses

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in API requests
• Enable and monitor Zabbix API access logs for suspicious sortfield parameter values containing SQL keywords
• Configure database query logging to identify anomalous queries originating from the Zabbix application
• Deploy intrusion detection systems with signatures for common blind SQL injection techniques including time-based payloads

Monitoring Recommendations

• Establish baseline metrics for API response times to detect time-based injection attempts causing artificial delays
• Monitor for multiple failed or unusual API authentication attempts followed by successful exploitation patterns
• Implement alerting on API requests containing common SQL injection test strings (e.g., 1' OR '1'='1, SLEEP(), BENCHMARK())
• Review Zabbix user accounts regularly to ensure API access is granted only to necessary users

How to Mitigate CVE-2026-23921

Immediate Actions Required

• Review and restrict API access permissions to essential users only, removing unnecessary low-privilege API accounts
• Implement network-level access controls to limit API endpoint exposure to trusted IP ranges
• Enable enhanced logging on Zabbix API endpoints to capture detailed request information for security monitoring
• Consider temporarily disabling API access if not operationally critical until patches are applied

Patch Information

Zabbix has acknowledged this vulnerability and tracking information is available through the Zabbix Support Issue ZBX-27640. Organizations should monitor this support ticket and Zabbix security advisories for official patch releases and upgrade to the patched version as soon as it becomes available.

Review the official Zabbix security communications and apply vendor-recommended patches following standard change management procedures. Ensure all Zabbix components are updated consistently to maintain compatibility.

Workarounds

• Implement a reverse proxy or WAF in front of Zabbix API endpoints with SQL injection filtering rules
• Restrict API access to only essential IP addresses using firewall rules or Zabbix's built-in access control mechanisms
• Audit and reduce the number of users with API access permissions, applying principle of least privilege
• Consider implementing additional authentication requirements for API access such as client certificates

# Configuration example - Restrict API access via web server (Apache example)
# Add to Zabbix Apache configuration to limit API access by IP
<Location /api_jsonrpc.php>
    Require ip 10.0.0.0/8
    Require ip 192.168.1.0/24
</Location>