CVE-2026-59786: Zabbix Server Authentication Bypass Flaw

CVE-2026-59786 Overview

CVE-2026-59786 is an authentication bypass vulnerability affecting Zabbix Server and Zabbix Proxy. The affected components accept active agent heartbeat messages without enforcing the configured pre-shared key (PSK) or TLS certificate authentication. An attacker with network reachability to the Zabbix trapper port can submit heartbeat traffic that reports arbitrary hosts as available. This undermines monitoring integrity and may mask real outages or agent failures. The weakness is categorized under [CWE-940: Improper Verification of Source of a Communication Channel].

Critical Impact
Unauthenticated network attackers can forge agent availability signals for arbitrary monitored hosts, causing a loss of monitoring integrity in Zabbix deployments.

Affected Products

Zabbix Server
Zabbix Proxy
Deployments relying on PSK or certificate authentication for active agents

Discovery Timeline

2026-10-05 - CVE-2026-59786 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-59786

Vulnerability Analysis

Zabbix supports active agents that initiate connections to the server or proxy and periodically send heartbeat messages indicating the agent is online. Deployments typically protect this channel with PSK or X.509 certificate authentication. The vulnerable code path processes incoming heartbeat messages on the trapper port without validating the configured authentication method. As a result, any client that can reach the trapper port can send a heartbeat on behalf of an arbitrary host identifier. The server marks the target host as available even though no legitimate agent sent the message. This creates a monitoring blind spot where real agent failures or host outages can be hidden by forged heartbeats.

Root Cause

The root cause is missing authentication enforcement on the active agent heartbeat message handler. The configured PSK or certificate requirement applies to other active agent traffic but is skipped when processing the heartbeat packet type. This matches the pattern described in [CWE-940], where the receiving endpoint fails to verify that the sender is authorized to use the channel.

Attack Vector

Exploitation requires network access to the Zabbix trapper port, typically TCP 10051 on the server or proxy. The attacker crafts a heartbeat payload referencing a target host name defined in Zabbix. No credentials, user interaction, or elevated privileges are required. The attack impacts integrity by falsifying host availability status. Confidentiality and availability are not directly affected. Full technical details are available in the Zabbix Bug Report ZBX-28196.

Detection Methods for CVE-2026-59786

Indicators of Compromise

Heartbeat messages received on the trapper port from source IP addresses that do not match the expected agent inventory.
Hosts showing available status in Zabbix while underlying infrastructure telemetry indicates the host or agent process is offline.
Unexpected gaps between heartbeat acknowledgments and actual item data collection for a given host.

Detection Strategies

Correlate Zabbix host availability events with independent signals such as ICMP reachability, log ingestion, and endpoint telemetry.
Inspect Zabbix server logs for heartbeat processing entries that lack an associated authenticated session.
Baseline the set of source IP addresses expected to send active agent traffic and alert on deviations.

Monitoring Recommendations

Enable network flow logging for TCP 10051 on Zabbix servers and proxies.
Monitor for sudden changes in host availability status that are not corroborated by item value updates.
Alert on repeated heartbeat connections from a single source referencing multiple distinct host identifiers.

How to Mitigate CVE-2026-59786

Immediate Actions Required

Restrict access to the Zabbix trapper port (TCP 10051) using firewall rules so only known agent subnets can connect.
Review host availability dashboards for anomalies and cross-check against independent monitoring sources.
Track the Zabbix Bug Report ZBX-28196 for the official fixed version and apply the patch when released.

Patch Information

Refer to the vendor advisory Zabbix Bug Report ZBX-28196 for the authoritative list of fixed versions and upgrade guidance. Apply the vendor-supplied update to Zabbix Server and Zabbix Proxy as soon as it is available in your supported branch.

Workarounds

Place Zabbix Server and Proxy trapper ports behind a network segmentation boundary or VPN that only authenticated agents can traverse.
Use host-based firewall rules on the Zabbix server to allow TCP 10051 only from the IP ranges of legitimate active agents.
Increase operator awareness that heartbeat-only availability signals should not be treated as proof of agent integrity until the patch is applied.

bash

# Example iptables rule restricting trapper port access to a trusted agent subnet
iptables -A INPUT -p tcp --dport 10051 -s 10.20.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 10051 -j DROP