CVE-2026-23937 Overview
CVE-2026-23937 is an information disclosure vulnerability in the Zabbix monitoring platform. The flaw resides in the host.get API action, which exposes a host's Pre-Shared Key (PSK) to authenticated users who should not have access to it. An attacker with valid Zabbix API credentials can query the endpoint and extract PSK material used to secure agent-to-server communications. Access to this key material can enable impersonation of monitored hosts and injection of forged telemetry, undermining the integrity of monitoring data. The issue is tracked upstream as ZBX-28074 and is categorized under CWE-203: Observable Discrepancy.
Critical Impact
Authenticated Zabbix users can retrieve host PSK keys via the API, enabling forged agent traffic and loss of monitoring data integrity.
Affected Products
- Zabbix (see vendor advisory ZBX-28074 for affected version list)
- Zabbix API host.get endpoint
- Deployments using PSK-based encryption between Zabbix server, proxy, and agents
Discovery Timeline
- 2026-08-18 - CVE-2026-23937 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-23937
Vulnerability Analysis
Zabbix uses PSK-based TLS to authenticate and encrypt traffic between the Zabbix server, proxies, and agents. The PSK identity and key are stored per host and are intended to remain confidential to administrators managing the encryption configuration. The host.get API action returns host configuration data based on user permissions, but it fails to filter PSK key material from the response for authenticated users who lack the privilege level required to view it. The flaw maps to [CWE-203], where a response discloses information that should be restricted based on caller privileges.
Root Cause
The root cause is missing or incomplete authorization on sensitive fields within the host.get API result set. The API returns encryption-related host attributes without enforcing the administrative role required to view PSK secret material. Low-privileged authenticated users therefore observe key data that should be redacted server-side.
Attack Vector
Exploitation requires network reachability to the Zabbix frontend or API and valid authenticated credentials with basic access. The attacker issues a standard JSON-RPC host.get request against the Zabbix API and parses the response for PSK key fields. No user interaction, elevated privileges, or additional exploit chain is required. Recovered PSK keys can then be reused to authenticate as the corresponding host and submit forged monitoring values or bypass integrity controls on server-agent channels.
Refer to Zabbix Issue ZBX-28074 for vendor-published technical details and fixed versions.
Detection Methods for CVE-2026-23937
Indicators of Compromise
- API access logs showing host.get requests from non-administrative user accounts querying fields related to TLS or PSK configuration.
- Sudden increase in host.get calls from a single authenticated user or API token across many host IDs.
- Monitored hosts submitting metric values that conflict with expected agent state, indicating possible PSK reuse by an attacker.
Detection Strategies
- Enable Zabbix audit logging and alert on host.get requests that include encryption-related output fields from low-privileged roles.
- Correlate API activity with user role assignments to identify accounts retrieving host inventory at abnormal volume.
- Baseline normal API consumers (dashboards, integrations) and flag deviations from expected client identifiers or source IPs.
Monitoring Recommendations
- Forward Zabbix frontend and API logs to a centralized SIEM or data lake for retention and correlation.
- Track authentication events for Zabbix user accounts and API tokens, especially newly created or rarely used identities.
- Monitor for unexpected changes in host PSK identities, which may indicate rotation gaps or attacker reuse.
How to Mitigate CVE-2026-23937
Immediate Actions Required
- Upgrade Zabbix to a fixed release as identified in the vendor advisory ZBX-28074.
- Rotate PSK identities and keys for all hosts if low-privileged users had access to the API prior to patching.
- Audit Zabbix user roles and remove API access from accounts that do not require it.
- Review API tokens and revoke any that are unused or over-privileged.
Patch Information
Zabbix has tracked the issue as ZBX-28074. Administrators should consult the Zabbix Issue ZBX-28074 advisory for the list of fixed versions and apply the corresponding upgrade for their deployment branch. After patching, verify that host.get responses no longer contain PSK secret material when queried by non-administrative accounts.
Workarounds
- Restrict Zabbix API access to trusted networks using firewall or reverse proxy allow-lists until patching is complete.
- Downgrade permissions of non-administrative user groups so they cannot invoke host.get on hosts with PSK encryption enabled.
- Migrate high-value hosts from PSK to certificate-based TLS authentication, which is not exposed through the affected field.
- Rotate PSK keys on a defined schedule to limit the exposure window of any previously leaked material.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
