Information disclosure in Zabbix - CVE-2026-59785
Published: October 5, 2026
Vulnerability identifier: #VU153278
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59785
CWE-ID: CWE-200
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose stored IPMI and PSK credentials.
The vulnerability exists due to improper access control in Frontend host search when filtering by fields that are not displayed. A remote user can send crafted search queries to disclose stored IPMI and PSK credentials.
Exploitation requires host read access.
Affected software
Zabbix
Fedora
zabbix6.0
zabbix
zabbix7.0
Fedora
zabbix6.0
zabbix
zabbix7.0
How to mitigate CVE-2026-59785
Install security update from vendor's website.
Zabbix - addressed in versions 6.0.48, 7.0.29, 7.4.13
zabbix6.0 - update to 6.0.48-1.el8
zabbix - update to 6.0.48-1.el9
zabbix7.0 - addressed in versions 7.0.31-1.el8, 7.0.31-1.el9, 7.0.31-1.el10_2, 7.0.31-1.el10_3, 7.0.31-1.el10_4
zabbix6.0 - update to 6.0.48-1.el8
zabbix - update to 6.0.48-1.el9
zabbix7.0 - addressed in versions 7.0.31-1.el8, 7.0.31-1.el9, 7.0.31-1.el10_2, 7.0.31-1.el10_3, 7.0.31-1.el10_4