Vulnerability · Published Mar 24, 2026 · Assigned by Zabbix
CVE-2026-23919Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server
High 7.1
In plain English
A high-severity security flaw in Zabbix from Zabbix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | zabbix | no fix listed | DEBIAN-CVE-2026-23919 |
| Debian:13 | zabbix | 1:7.0.22+dfsg-1~deb13u1 | DEBIAN-CVE-2026-23919 |
| Debian:14 | zabbix | 1:7.0.22+dfsg-1 | DEBIAN-CVE-2026-23919 |
| Ubuntu:25.10 | zabbix | no fix listed | UBUNTU-CVE-2026-23919 |
Affected products (as reported)
Weakness: CWE-488 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L