CVE-2026-23930: Frontend Webserver DOS Vulnerability

CVE-2026-23930 Overview

CVE-2026-23930 is a denial of service vulnerability in the Zabbix Frontend web interface. An unauthenticated attacker on an adjacent network can send specifically crafted requests to the popup.testtriggerexpr action. The requests cause the Frontend webserver to consume disproportionate CPU resources.

The flaw is classified under [CWE-405] Asymmetric Resource Consumption. Successful exploitation degrades Zabbix Frontend availability without requiring authentication or user interaction. The Zabbix issue tracker records this defect as ZBX-28069.

Critical Impact
Unauthenticated adjacent-network attackers can exhaust CPU on the Zabbix Frontend webserver, disrupting monitoring visibility across managed infrastructure.

Affected Products

Zabbix Frontend (see Zabbix Issue Tracker ZBX-28069 for affected versions)
The popup.testtriggerexpr action handler in the Zabbix web interface
No specific CPE identifiers were published in the NVD record at time of writing

Discovery Timeline

2026-08-18 - CVE-2026-23930 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-23930

Vulnerability Analysis

The vulnerability resides in the Zabbix Frontend popup.testtriggerexpr action. This action evaluates trigger expressions submitted through the popup interface. An attacker submits specifically crafted expression payloads that force the parser or evaluator to perform work disproportionate to the input size.

The result is asymmetric resource consumption on the Frontend webserver. Repeated requests amplify the CPU load and can render the monitoring interface unresponsive. Zabbix administrators lose visibility into infrastructure health while the attack is ongoing.

Root Cause

The root cause is missing or insufficient input constraints on trigger expressions passed to the popup.testtriggerexpr endpoint. The evaluator processes attacker-controlled expressions without adequate complexity limits or execution ceilings. This aligns with [CWE-405] where small inputs generate large computational costs.

Because the endpoint does not require authentication for this request path, the attack surface extends to any network-adjacent client that can reach the Frontend.

Attack Vector

Exploitation requires network adjacency to the Zabbix Frontend, no privileges, and no user interaction. An attacker crafts HTTP requests targeting the popup.testtriggerexpr action with expressions designed to maximize parser or evaluator work. Sending these requests in a loop amplifies CPU pressure on the webserver process.

No public proof-of-concept exploit is currently listed in the NVD references. Technical details are tracked in the Zabbix Issue Tracker ZBX-28069.

Detection Methods for CVE-2026-23930

Indicators of Compromise

Repeated HTTP requests to the Zabbix Frontend containing the action=popup.testtriggerexpr parameter from a single or small set of source addresses.
Sustained high CPU utilization on the PHP-FPM or webserver worker processes serving the Zabbix Frontend.
Slow or failed responses from the Zabbix web interface without corresponding backend server load.

Detection Strategies

Inspect webserver access logs for unauthenticated requests to popup.testtriggerexpr with unusually complex or large expression parameters.
Correlate spikes in Frontend response latency with request bursts targeting the popup action endpoint.
Baseline typical request rates to popup.* actions and alert on statistical deviations.

Monitoring Recommendations

Enable request rate metrics on the Zabbix Frontend reverse proxy and alert on per-source thresholds.
Monitor Frontend webserver CPU and process runtime for sustained saturation events.
Forward webserver access logs to a centralized log platform for retention and query.

How to Mitigate CVE-2026-23930

Immediate Actions Required

Restrict network access to the Zabbix Frontend to trusted management networks using firewall or reverse proxy rules.
Place the Frontend behind a reverse proxy that enforces rate limiting on popup.testtriggerexpr requests.
Review Zabbix Issue Tracker ZBX-28069 for the fixed version list and upgrade path.

Patch Information

Zabbix tracks the fix under issue ZBX-28069. Administrators should apply the vendor-supplied Frontend update once available for their release branch. Consult the Zabbix Issue Tracker ZBX-28069 for version-specific patch details and release notes.

Workarounds

Block or rate-limit unauthenticated access to the popup.testtriggerexpr action at the reverse proxy layer.
Require authentication in front of the Zabbix Frontend using an upstream identity-aware proxy.
Constrain source IPs allowed to reach the Frontend to internal administrative ranges only.

bash

# Example nginx rate limit for the popup action endpoint
limit_req_zone $binary_remote_addr zone=zbxpopup:10m rate=5r/m;

location ~ ^/zabbix/.*popup\.php$ {
    limit_req zone=zbxpopup burst=5 nodelay;
    proxy_pass http://zabbix_frontend_upstream;
}