CVE-2026-23922

Executive Summary

CVE-2026-23922 is an information disclosure vulnerability affecting the Zabbix monitoring platform's email media OAuth configuration. A Super Admin with legitimate access can exploit a flaw in the handling of the OAuth 'Client secret' field to leak sensitive credentials by configuring a malicious 'Token endpoint' URL. The vulnerability requires high privileges (Super Admin) but no user interaction, and can be exploited remotely over the network. The CVSS score is 4.9 (Medium), with the primary impact being confidentiality loss of OAuth client credentials. The vendor has addressed the issue by resetting the client secret whenever the token endpoint is changed. No CISA KEV listing or evidence of exploitation in the wild has been identified at the time of this report.

Technical Analysis

CVE-2026-23922 falls under CWE-522 (Insufficiently Protected Credentials) and involves a flaw in Zabbix's handling of OAuth 2.0 configuration for email media channels.

Vulnerability Mechanism:

The NVD description reveals a two-part problem within Zabbix's email media OAuth configuration:

1. Read Restriction Bypass via Token Endpoint Manipulation: Under normal operation, the OAuth 'Client secret' field cannot be read back once it has been saved — a standard security practice to prevent credential exposure through the web interface. However, a Super Admin can circumvent this protection by setting a malicious or attacker-controlled 'Token endpoint' URL. When Zabbix subsequently attempts to interact with this endpoint (e.g., during a token exchange or validation process), the client secret is transmitted or otherwise made readable, allowing the Super Admin to leak it.

2. Improper State Management on Configuration Change: The core flaw is that changing the 'Token endpoint' field did not invalidate or reset the existing 'Client secret'. This is an improper state synchronization issue — the system allowed modification of one OAuth parameter (the token endpoint) without enforcing re-authentication or re-entry of the associated secret. This inconsistency enabled the credential disclosure described above.

Attack Surface:

• Authentication Required: High (Super Admin role)
• Attack Vector: Network (AV:N) — the vulnerability is exploitable over the network via the Zabbix web frontend
• User Interaction: None required (UI:N)
• Privileges Required: High (PR:H)

The attack surface is limited to authenticated users with Super Admin privileges. However, in multi-tenant or enterprise deployments where administrative access is shared or delegated across teams, the risk surface expands. A malicious or compromised Super Admin account could exfiltrate OAuth credentials for email integration. These credentials could then be reused against the OAuth provider (e.g., Microsoft Graph API for Exchange Online) to gain unauthorized access to email systems beyond Zabbix.

Technical Details:

Insufficient technical detail is available regarding specific function names, code paths, or request parameters. The NVD description does not disclose internal implementation details. The vulnerability class, however, is clear: improper handling of sensitive credentials during a configuration state change — specifically, the failure to reset or invalidate a credential (client secret) when a related configuration parameter (token endpoint) is modified. This allows a privileged user to trigger an outbound request to a controlled endpoint and capture the secret in transit or in logs.

Vendor Fix:

The vendor implemented a change to reset the client secret upon any modification to the token endpoint. This ensures that a stale credential cannot be leaked when the endpoint is swapped to an attacker-controlled value.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification: An attacker must first obtain valid credentials for a Zabbix Super Admin account. This could be achieved through credential stuffing, phishing, insider threat, or compromise of an administrator's workstation. The target is the Zabbix web frontend, reachable over the network (AV:N). The attacker identifies the email media configuration page where OAuth settings for the mail integration are managed.

Step 2 — Triggering the Flaw: Once authenticated as a Super Admin, the attacker navigates to the email media type configuration (or equivalent) and locates the OAuth section containing the 'Client secret' and 'Token endpoint' fields. The victim (or the legitimate admin) has previously saved a valid OAuth configuration, including a client secret that the web interface normally masks and refuses to display after saving.

Step 3 — Payload / Execution Method: The attacker sets the 'Token endpoint' field to a URL under their control (e.g., https://attacker.example.com/token). Because the application fails to reset the client secret upon this change, the existing secret remains active in the configuration. The attacker then triggers an action that forces Zabbix to communicate with the token endpoint — such as saving the configuration, testing the email connection, or initiating an OAuth token refresh. When Zabbix performs the HTTP request to the attacker-controlled endpoint, the client secret is transmitted (either in the request body as a form parameter per OAuth 2.0 spec, or in a manner that allows the attacker to capture it via server logs).

Step 4 — Post-Exploitation Impact: The attacker captures the client secret from their server logs. This secret, combined with the known OAuth client ID, can then be used to request access tokens from the legitimate OAuth provider (e.g., Azure AD, Google). These tokens may grant access to the connected email system (Exchange Online, Gmail, etc.), enabling mailbox access, email exfiltration, or lateral movement to other connected cloud services. The confidentiality impact score is High (C:H), reflecting the severity of credential exposure.

Impact Assessment

CVSS Breakdown (derived from vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N):

• Confidentiality: High — the OAuth client secret is exposed to a privileged user who should not be able to read it
• Integrity: None
• Availability: None
• Scope: Unchanged — the compromise is confined to Zabbix's security context

Business Impact:

The primary risk is credential theft for integrated email/OAuth services. The 'Client secret' for email media OAuth typically corresponds to an application registration in a cloud identity provider (e.g., Azure AD app registration for Microsoft 365 integration). With this secret and the associated client ID, an attacker can:

1. Obtain OAuth tokens for the registered application, potentially accessing mailboxes or sending email as the organization.
2. Maintain persistence by refreshing tokens even if password-based credentials are rotated.
3. Bypass conditional access policies that may not be applied to service principals.

Affected Systems:

All Zabbix deployments using OAuth 2.0-based email media integrations are potentially affected. This includes integrations with Microsoft 365/Exchange Online, Google Workspace, and other SMTP services that support OAuth. The vulnerability is particularly relevant in environments where Super Admin access is shared among multiple administrators or where the Zabbix instance manages integrations for sensitive mailboxes.

Blast Radius:

The attacker must have Super Admin privileges, which limits the attack population. However, the compromise of a single Super Admin account can result in the theft of OAuth credentials that provide access to external services — expanding the blast radius beyond the Zabbix platform itself. Given the EPSS score of 0.00283 (low — 20.5th percentile of exploited CVEs), active exploitation in the wild is currently unlikely, but this could change as more details about the attack mechanics become public.

Detection Guidance

The exploitation of this vulnerability occurs primarily through legitimate administrative actions in the Zabbix web interface. Detection should focus on monitoring configuration changes to OAuth settings, particularly modifications to the 'Token endpoint' field, and on outbound network connections to unusual token endpoints.

Sigma Rule

title: Zabbix OAuth Token Endpoint Modification
id: 8a5c9e1b-4f2d-4a3e-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects changes to OAuth token endpoint configuration in Zabbix email media settings, potentially indicating exploitation of CVE-2026-23922
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-23922
    - https://www.zabbix.com/
author: valtersit.com Threat Intelligence
date: 2026/03/15
logsource:
    product: zabbix
    service: audit
detection:
    selection:
        event_type: 'configuration.update'
        resource_type: 'media_type'
        field_changed: 'token_endpoint'
    condition: selection
level: high
falsepositives:
    - Legitimate administrative changes to email integration configuration
tags:
    - attack.t1078
    - attack.collection
    - cve.2026-23922

YARA Rule

/*
    YARA rule to detect strings associated with Zabbix OAuth configuration
    attempts matching CVE-2026-23922 exploitation patterns
*/
rule Zabbix_OAuth_Token_Endpoint_Leak_CVE_2026_23922
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects log entries or configuration files referencing OAuth token endpoint changes in Zabbix"
        date = "2026-03-15"
        cve = "CVE-2026-23922"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-23922"

    strings:
        $s1 = "token_endpoint" ascii wide
        $s2 = "client_secret" ascii wide
        $s3 = "oauth" ascii wide
        $s4 = "media_type" ascii wide
        $s5 = "mail" ascii wide

    condition:
        3 of them
}

Suricata IDS Rule

# Note: This vulnerability is exploited through the Zabbix web interface over HTTPS.
# Detection focuses on outbound HTTP POST requests to suspicious token endpoints,
# which may indicate an admin exfiltrating OAuth secrets.

alert http any any -> $EXTERNAL_NET any (
    msg:"Potential Zabbix OAuth Client Secret Exfiltration (CVE-2026-23922)";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"grant_type";
    http_client_body;
    content:"client_secret";
    http_client_body;
    noregex;
    pcre:"/^Host:\s[^\r\n]*(?!(.*zabbix|.*microsoftonline|.*googleapis|.*login\.microsoftonline))/mi";
    reference:cve,2026-23922;
    classtype:attempted-user;
    sid:102926922;
    rev:1;
    metadata:created_at 2026_03_15, updated_at 2026_03_15;
)

Elastic Detection

// Detect modification of Zabbix email media OAuth settings
configuration where process.name == "zabbix_server" or event.action == "change"
    and event.category in ("configuration", "authentication")
    and any(message like~ "*token endpoint*" or message like~ "*token_endpoint*")
    and any(message like~ "*client secret*" or message like~ "*client_secret*")
    and user.roles like~ "*Super Admin*" or user.roles like~ "*super_admin*"

Splunk SPL Query

index=zabbix sourcetype="zabbix:audit" OR sourcetype="zabbix:config"
| search "token_endpoint" OR "Token endpoint"
| search "client_secret" OR "Client secret"
| eval malicious=ture
| table _time, user, src_ip, action, media_type, changed_field, new_value
| sort -_time
| search changed_field="token_endpoint" 
| stats count min(_time) as first_seen max(_time) as last_seen by user, src_ip, media_type

Wazuh OSSEC Rule

<group name="zabbix,">
  <rule id="102926" level="10">
    <decoded_as>json</decoded_as>
    <field name="product">zabbix</field>
    <match>token_endpoint</match>
    <match>client_secret</match>
    <description>Zabbix: OAuth token endpoint and client secret modification detected - potential CVE-2026-23922 exploitation</description>
    <group>cve_2026_23922,</group>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY — confirmed by 2 independent sources: NVD and Debian).

Additional context: The vendor fix resets the OAuth client secret whenever the token endpoint configuration is changed. This prevents the secret from being actively used when an administrator points the endpoint to an external or malicious URL.

1. Immediate Mitigations:

   • Restrict Super Admin access: Limit the number of users with Super Admin privileges to the minimum necessary. Review and audit the current Super Admin list.
   • Monitor audit logs: Actively scan for any changes to email media type OAuth configurations, specifically modifications to the token endpoint.
   • Review current endpoint values: Verify that all configured OAuth token endpoints for email media point to legitimate, expected OAuth providers (e.g., login.microsoftonline.com, oauth2.googleapis.com).
   • Rotate existing secrets: If any suspicious configuration changes are detected, immediately rotate the OAuth client secrets for affected email integrations. This will invalidate any credentials potentially leaked.

2. Patch / Upgrade Steps:

   • Monitor official Zabbix release channels for the security fix advisory.
   • Apply the vendor patch or upgrade to the patched Zabbix version as soon as it is released and tested in your environment.
   • When applying the upgrade, review release notes for confirmation of the CVE-2026-23922 fix.
   • After patching, reconfigure email OAuth integrations to ensure the fix is properly applied. The fix will reset client secrets when the token endpoint is changed; ensure your legitimate configuration is re-established correctly.

3. Long-term Hardening:

   • Implement strict change management procedures for any Zabbix configuration changes, requiring sign-off from a secondary administrator when OAuth or email settings are modified.
   • Deploy an advanced SIEM/SOC capability to detect anomalous access patterns to Zabbix administrative interfaces.
   • Enable multi-factor authentication (MFA) for all Zabbix administrative accounts to reduce the risk of credential compromise.
   • Conduct regular audits of OAuth application registrations in your cloud identity provider to identify unused or suspicious applications.
   • Leverage infrastructure-as-code and version-controlled configuration management to track and review Zabbix configuration changes.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-23922
2. Zabbix Official Site & Advisories: https://www.zabbix.com/
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-23922
4. CWE-522 Reference (OWASP/CWE): https://cwe.mitre.org/data/definitions/522.html
5. Microsoft OAuth 2.0 Documentation (context for exploitation): https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-23922 has been identified as of the reporting date. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00283 indicates a low probability of exploitation in the near term, but this score is dynamic and should be re-evaluated as more technical details become public.