Zabbix CVE-2026-23931

Exploitation requires a valid authenticated Zabbix frontend account - at minimum a low-privilege user role, consistent with the CVSS PR:L metric. The attack is conducted over the network against the Zabbix web frontend with no special client-side configuration needed. The vulnerability is only impactful when user macros in the target environment contain sensitive plaintext values; deployments where macros store only non-sensitive configuration data face negligible real-world impact. Exploitation is limited by the authentication requirement - unauthenticated external actors cannot invoke the vulnerable action directly. Zabbix instances that have already migrated sensitive values to the 'secret' macro type (Zabbix 5.2+) may also limit the impact of successful exploitation.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects the bounded scope: the attack requires network access and an authenticated Zabbix frontend account (PR:L), is low complexity with no additional attack prerequisites (AC:L, AT:N), and produces only confidentiality impact on the vulnerable system (VC:L). However, the practical severity is context-dependent - in environments where user macros store privileged credentials, the effective impact can be significantly higher than the metric alone conveys, because a single macro disclosure could expose lateral movement paths. No CISA KEV listing has been identified, indicating no confirmed widespread active exploitation. No EPSS data was provided. No POC code has been identified at time of analysis. The vulnerability is most critical in multi-tenant or multi-user Zabbix deployments where lower-privilege accounts should not have visibility into all macro values. The authentication requirement (PR:L) is the primary limiting factor - unauthenticated external attackers cannot exploit this directly.

An authenticated Zabbix frontend user with a standard low-privilege account crafts a request to the validatate.api.exists API action, targeting a known or enumerated user macro by name. The API response returns the plaintext value of the macro rather than the obfuscated representation shown in the UI, exposing embedded credentials such as a database password or API key. No public exploit code has been identified at time of analysis, but the attack is low-complexity and requires only a valid Zabbix frontend session.