CVE-2026-23919: Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server
For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/knownissues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23919?
CVE-2026-23919 is rated as a high-severity vulnerability due to its potential impact on confidentiality.
How do I fix CVE-2026-23919?
To mitigate CVE-2026-23919, ensure that you update your Zabbix Server or Zabbix Proxy to the latest patched version provided by Zabbix.
What software is affected by CVE-2026-23919?
CVE-2026-23919 affects Zabbix Server and Zabbix Proxy.
What kind of risk does CVE-2026-23919 pose to Zabbix admins?
CVE-2026-23919 poses a risk of confidentiality loss for regular (non-super) Zabbix admins due to insufficient isolation of JavaScript execution.
Does CVE-2026-23919 impact all users of Zabbix?
CVE-2026-23919 primarily impacts users with regular administrative privileges who may inadvertently gain access to sensitive data.