CVE-2026-23933 in Zabbix
Summary
by MITRE • 08/18/2026
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in Zabbix version 7.4 represents a critical configuration error within the application's cryptographic infrastructure, specifically concerning the management of signing keys for Frontend sessions. In secure web applications, session cookies are typically signed using a secret key to ensure their integrity and authenticity, preventing tampering by malicious actors. However, in this specific instance, the cryptographic key intended solely for internal use or initialization was erroneously persisted into the database seed file. This misconfiguration results in the exposure of sensitive security material that should remain confidential and dynamic, thereby undermining the fundamental trust model established between the server and client during authentication processes.
The operational impact of this flaw is contingent upon the specific deployment architecture employed by the organization. The vulnerability primarily affects environments where both SAML-based single sign-on integration and guest user access are enabled simultaneously. In these scenarios, an attacker who gains read access to the database seed file can extract the signing key. With this key in hand, it becomes possible to forge valid session cookies that bypass standard authentication checks. This capability allows for unauthorized access to the Zabbix interface without requiring valid credentials, effectively granting the attacker full control over the compromised account or guest privileges depending on how the forged token is utilized within the application logic.
From a technical classification perspective, this issue aligns with CWE-798: Use of Hard-coded Credentials and CWE-203: Observable Discrepancy in Cryptographic Operations. The exposure of the signing key through persistent storage violates principles of secure secret management as outlined by industry standards such as OWASP Secure Coding Practices. Furthermore, the exploitation vector relates to ATT&CK technique T1556.004: Modifying Authentication Process via SAML authentication bypass mechanisms, although the root cause is a failure in proper credential isolation rather than an active modification of the protocol itself. The risk is further compounded by CWE-327: Use of a Broken or Risky Cryptographic Algorithm if the key generation process was also suboptimal, though the primary issue here is the improper storage and exposure of otherwise secure material.
Mitigation strategies must focus on immediate remediation of the configuration error followed by long-term architectural improvements to secret management practices. Administrators should immediately rotate all cryptographic keys associated with session signing across their Zabbix infrastructure. It is imperative that these new secrets are generated using a cryptographically strong random number generator and stored in environment variables or dedicated secure vaults rather than within database seed files or configuration scripts accessible via version control systems. For deployments utilizing SAML authentication, it is recommended to review access controls for guest users and ensure that session validation logic strictly verifies the signature against a secret key that is never persisted in plaintext within application data stores. Regular security audits of deployment configurations should be implemented to detect similar misconfigurations where sensitive keys are inadvertently exposed through persistent storage mechanisms or debug outputs.