CVE-2026-59787: Zabbix SNMP Trap Injection Vulnerability

CVE-2026-59787 Overview

CVE-2026-59787 affects the Perl SNMP trap receiver script distributed with Zabbix. The script fails to properly neutralize the ZBXTRAP record delimiter contained within trap content. An authenticated sender of Simple Network Management Protocol (SNMP) traps can inject a crafted record that targets a different monitored host, resulting in a loss of integrity for Zabbix trap data. The weakness is classified under CWE-143: Improper Neutralization of Record Delimiters. The flaw does not expose confidentiality or availability, but it undermines the trustworthiness of SNMP trap records consumed by Zabbix.

Critical Impact
Attackers who can send SNMP traps can forge trap records attributed to arbitrary monitored hosts, corrupting monitoring data and potentially masking malicious activity.

Affected Products

Zabbix distributions that ship the Perl SNMP trap receiver script
Zabbix server deployments ingesting SNMP traps via the bundled Perl receiver
Environments relying on ZBXTRAP as the record delimiter for trap parsing

Discovery Timeline

2026-10-05 - CVE-2026-59787 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-59787

Vulnerability Analysis

Zabbix uses a Perl receiver script to process incoming SNMP traps forwarded by snmptrapd. The script parses trap text and uses the literal string ZBXTRAP as a record delimiter to separate individual trap records before writing them to the Zabbix trap file. Because the script does not sanitize or escape the ZBXTRAP token when it appears inside trap payload content, an attacker who can inject arbitrary strings into trap data can embed a second ZBXTRAP marker. The receiver then treats the injected material as a new, independent record. This record can declare any source host IP address and alert text, which Zabbix subsequently associates with a different monitored host. The result is integrity loss across monitoring data without needing credentials for the targeted host.

Root Cause

The root cause is improper neutralization of a record delimiter inside user-controllable input [CWE-143]. The Perl trap receiver trusts that ZBXTRAP appears only as a framing token generated by snmptrapd, and it does not escape or reject the token when it is embedded within variable bindings or trap OID values.

Attack Vector

Exploitation requires the ability to deliver an SNMP trap that reaches the Zabbix trap receiver. An attacker who can send traps crafts a payload whose variable bindings contain the literal string ZBXTRAP followed by a forged header line and alert body. When the Perl script parses the trap file, the embedded delimiter causes the forged content to be interpreted as a distinct trap record attributed to a host of the attacker's choosing. Full technical context is tracked in the Zabbix issue ZBX-28197. No verified public exploit code is referenced in the advisory.

Detection Methods for CVE-2026-59787

Indicators of Compromise

Entries in the Zabbix SNMP trap file where the ZBXTRAP token appears inside the trap body rather than only at record boundaries.
Trap records attributing alerts to host IP addresses that do not match the originating SNMP sender address recorded by snmptrapd.
Unexpected trap volume from a single SNMP source referencing multiple distinct target hosts.

Detection Strategies

Compare the source address logged by snmptrapd against the host identifier parsed by Zabbix for each trap record and flag mismatches.
Parse the trap file for occurrences of ZBXTRAP and alert when more delimiter instances appear than discrete inbound traps received.
Review Zabbix audit logs for triggers that fired against hosts whose network path should not permit traps from the recorded sender.

Monitoring Recommendations

Forward snmptrapd and Zabbix trap files into a centralized logging platform for correlation with network flow data.
Baseline normal SNMP trap sources per monitored host and alert on deviations.
Monitor changes to the Perl trap receiver script and its invocation parameters.

How to Mitigate CVE-2026-59787

Immediate Actions Required

Restrict SNMP trap ingestion to trusted network segments and known device IP ranges using firewall or ACL controls.
Require SNMPv3 with authentication and privacy for trap senders where supported, and reject SNMPv1 and SNMPv2c traps from untrusted sources.
Audit existing Zabbix trap files for anomalous ZBXTRAP delimiter placement and reconcile suspicious alerts.

Patch Information

Refer to the Zabbix issue ZBX-28197 for fix status and version guidance. Apply the Zabbix-supplied update to the Perl SNMP trap receiver script when available, and validate that the patched script escapes or rejects embedded ZBXTRAP tokens before writing records.

Workarounds

Replace the bundled Perl receiver with a hardened parser that escapes any occurrence of ZBXTRAP within trap variable bindings before writing to the trap file.
Terminate SNMP trap collection on a dedicated host that filters payloads containing the literal ZBXTRAP string prior to forwarding.
Disable SNMP trap processing entirely where traps are not required for monitoring.

bash

# Example iptables restriction limiting UDP/162 to approved SNMP sources
iptables -A INPUT -p udp --dport 162 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 162 -j DROP