CVE-2026-23922 Overview
CVE-2026-23922 is a credential exposure vulnerability in the Zabbix email media OAuth configuration. The Client secret field is write-only in the user interface and cannot be read back after saving. However, a Super Admin can leak the stored secret by modifying the Token endpoint to point to an attacker-controlled URL. When Zabbix performs the OAuth token exchange, it transmits the client secret to the attacker-controlled endpoint. The issue is tracked by Zabbix as ZBX-28067 and is classified under [CWE-522] Insufficiently Protected Credentials.
Critical Impact
A Super Admin account can exfiltrate stored OAuth Client secret values that the UI is designed to protect from disclosure.
Affected Products
- Zabbix (email media OAuth configuration)
- See ZBX-28067 for the affected version list
Discovery Timeline
- 2026-08-18 - CVE-2026-23922 published to the National Vulnerability Database (NVD)
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-23922
Vulnerability Analysis
Zabbix supports OAuth 2.0 for email media types. Administrators configure a Client ID, Client secret, and Token endpoint. The application intentionally masks the Client secret in the UI after it is saved, preventing casual disclosure to other administrators.
The protection fails because the stored secret is reused whenever the token endpoint is called. A Super Admin can edit the media configuration and change the Token endpoint URL while leaving the secret field untouched. On the next OAuth token request, Zabbix sends the retained secret to the newly configured endpoint. An attacker-controlled server logs the incoming request and captures the plaintext value.
The vulnerability requires Super Admin privileges, which limits the practical attack surface. The impact is confined to confidentiality of a stored credential, with no direct effect on integrity or availability of the Zabbix server itself.
Root Cause
The application does not invalidate or require re-entry of the Client secret when the Token endpoint value changes. The fix described in ZBX-28067 resets the client secret whenever the token endpoint is modified, forcing the operator to re-enter it and preventing silent redirection of the credential.
Attack Vector
An authenticated Super Admin navigates to the email media type configuration. The attacker replaces the legitimate Token endpoint with a URL under their control. On the next OAuth flow triggered by Zabbix, the server sends an HTTP POST containing the stored client_secret parameter to the attacker endpoint. The attacker reads the value from their web server logs.
See the Zabbix advisory ZBX-28067 for technical details of the OAuth token exchange behavior.
Detection Methods for CVE-2026-23922
Indicators of Compromise
- Outbound HTTPS requests from the Zabbix server to unexpected or newly registered domains during OAuth token exchange
- Audit log entries showing modifications to the Token endpoint field of an email media type without a corresponding Client secret update
- Zabbix email delivery failures immediately following a media type configuration change, indicating a redirected OAuth flow
Detection Strategies
- Review Zabbix audit logs for mediatype.update actions that changed only the token endpoint field
- Compare current media type configuration against a known-good baseline of authorized OAuth endpoints
- Alert on any Super Admin session that modifies media type OAuth settings outside change windows
Monitoring Recommendations
- Enforce egress filtering from the Zabbix server so OAuth requests can only reach approved provider domains (for example, login.microsoftonline.com, oauth2.googleapis.com)
- Forward Zabbix audit logs to a central SIEM and build detections on media type configuration changes
- Monitor creation of new Super Admin accounts and unusual administrative activity outside business hours
How to Mitigate CVE-2026-23922
Immediate Actions Required
- Upgrade Zabbix to a fixed version as identified in ZBX-28067
- Rotate any OAuth Client secret values previously configured in email media types, treating them as potentially disclosed
- Review the list of accounts holding the Super Admin role and remove unnecessary assignments
- Audit historical media type changes and validate that all configured token endpoints belong to legitimate identity providers
Patch Information
Zabbix has addressed the issue by resetting the stored Client secret whenever the Token endpoint value is changed. Operators must re-enter the secret after editing the endpoint, which prevents silent redirection of the credential to an attacker-controlled URL. Refer to ZBX-28067 for fixed release versions.
Workarounds
- Restrict the Super Admin role to a minimum number of trusted operators
- Apply network egress controls that allow the Zabbix frontend and server to reach only sanctioned OAuth provider endpoints
- Require multi-party review for all changes to media type OAuth configuration through change management processes
- Rotate OAuth client credentials on a scheduled basis to limit the value of any leaked secret
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
