CVE-2026-23929

Executive Summary

CVE-2026-23929 is a prototype pollution vulnerability in Zabbix's searchParamsToObject() function that enables persistent Cross-Site Scripting (XSS) in the Maps module. The flaw stems from insufficient filtering of dangerous object properties (e.g., __proto__) during URL parameter processing, which — when combined with jQuery's unsafe element creation that traverses the prototype chain — allows an authenticated attacker to inject and persistently execute arbitrary JavaScript in the context of other users viewing Maps. With a CVSS score of 5.4 (Medium) and an EPSS probability of 0.296%, the vulnerability is not currently known to be exploited in the wild (not listed in CISA KEV), but public exploit availability elevates the risk profile for unpatched Zabbix deployments. Affected organizations should prioritize patching given the authenticated attack vector and persistent impact on monitoring dashboards trusted by security teams.

Technical Analysis

Vulnerability Mechanism

The vulnerability resides in the JavaScript function searchParamsToObject(), which is responsible for converting URL search parameters into a JavaScript object. The core flaw is a prototype pollution condition (CWE-1321) triggered by insufficient sanitization of parameter keys.

The attack mechanism can be understood as follows:

1. Insufficient Key Filtering: The function processes URL parameters without adequately filtering or rejecting dangerous property names such as __proto__, constructor, and prototype. When a URL parameter like ?__proto__[polluted]=true is processed, the function attempts to assign this key to the resulting object.

2. Prototype Chain Contamination: Because __proto__ is a special accessor in JavaScript, assigning to it modifies the prototype of the object (Object.prototype), effectively polluting the prototype chain for all subsequent objects created in the page's JavaScript context.

3. jQuery Unsafe Element Creation: The NVD description explicitly states that Zabbix's Maps feature uses jQuery for element creation in a way that "traversed the prototype chain." When jQuery creates DOM elements (e.g., via $() or .html()), certain properties used during creation (such as event handlers, attributes, or internal configuration) may be looked up through the prototype chain. If an attacker has polluted Object.prototype with a malicious property (e.g., setting Object.prototype.onload or Object.prototype.srcdoc), jQuery's element creation will inherit these polluted properties, resulting in the execution of attacker-controlled code.

4. Persistent XSS: Because Maps in Zabbix are configuration objects stored server-side and rendered to multiple users, the pollution can persist in the browser context beyond a single request. When other authenticated users (or users with view access to the polluted Map) load the page, the polluted prototype properties cause jQuery to generate malicious elements, executing the attacker's JavaScript payload in the victim's session.

Attack Surface

The attack surface comprises:

• Zabbix Web Frontend: The Maps feature accessible to authenticated users with at least the ability to view or configure maps (typically "User" role with map access, or higher privileges).
• URL Parameter Handling: Any endpoint that passes user-controlled URL parameters through searchParamsToObject().
• jQuery DOM Manipulation: The Maps rendering code that creates elements using jQuery methods susceptible to prototype chain traversal.

It is important to note that the specific affected URL endpoints and the exact jQuery usage patterns are not disclosed in the NVD description. The description confirms only the function name searchParamsToObject() and the Maps module as the impacted feature.

Vulnerability Class

This is a DOM-based prototype pollution leading to DOM-based XSS. The root cause is a classic prototype pollution pattern: unsafe recursive merging or assignment of object properties from untrusted input (URL parameters) without filtering keys such as __proto__.

Exploitation Scenarios

Preconditions:

• Attacker must have a valid authenticated session on the Zabbix web frontend (CVSS: PR:L).
• Attacker requires the ability to view or interact with the Maps feature (typically granted to monitoring or admin users).
• The victim must be a user who can view the polluted Map (UI:R).

Attack Chain:

1. Reconnaissance/Target Identification: An authenticated attacker identifies a Zabbix web frontend. Unauthenticated reconnaissance may confirm Zabbix version via login page fingerprints (e.g., zabbix.php endpoints, version strings in page source or API). The attacker determines whether they have access to a Map or can create/modify one, and identifies a URL that accepts parameters processed by searchParamsToObject().

2. Flaw Trigger — Prototype Pollution: The attacker crafts a malicious URL containing prototype-polluting parameters. At the vulnerability-class level, the URL includes a parameter structure like ?__proto__[property]=value or ?constructor[prototype][property]=value (exact syntax depends on the parsing logic of searchParamsToObject(), which is not publicly detailed). The attacker targets properties that jQuery will later read during element creation — common candidates in prototype-pollution-to-XSS chains include onload, srcdoc, innerHTML, or autofocus. The attacker sends this URL to themselves to trigger the pollution in their own browser, or embeds it in a crafted link to another user (e.g., via a message or crafted page URL).

3. Payload Execution — Persistent XSS: When the polluted Map page is rendered in any victim's browser, jQuery attempts to create DOM elements for map markers, shapes, or labels. Because Object.prototype has been polluted with an attacker-controlled property, the element creation inherits that property. Depending on the property polluted, the browser may:

   • Fire an event handler (e.g., onload) pointing to attacker-controlled JavaScript,
   • Render HTML from a polluted srcdoc or innerHTML property,
   • Execute JavaScript via a polluted tag attribute (e.g., src, href).

   The attacker's injected script now executes persistently for every user who views the polluted Map.

4. Post-Exploitation Impact: The attacker's JavaScript executes in the context of the victim's Zabbix session. Depending on the victim's privileges, the attacker can:

   • Steal session cookies/tokens (CVSS C:L), enabling session hijacking.
   • Escalate privileges by performing actions as the victim — e.g., if the victim is an admin, the attacker can modify Zabbix configurations, create backdoor users, alter host/trigger definitions, disable monitoring, or exfiltrate sensitive infrastructure data (host names, IPs, credentials stored in macros).
   • Pivot to internal infrastructure: Zabbix instances often hold network-mapping data, credentials for monitored hosts, and integration tokens (e.g., for notification services), making them a valuable foothold for lateral movement into the monitored environment.

Exploit Availability: Public exploit exists, though no Nuclei template or standalone exploit code is available. The exact exploit technique is inferred from the vulnerability class; attack chains may vary based on the precise jQuery property that is most effective for RCE/XSS in the specific Zabbix version.

Impact Assessment

CVSS Analysis (5.4 Medium):

• Attack Vector: Network — exploitable remotely via HTTP requests to the web frontend.
• Attack Complexity: Low — no special conditions beyond URL crafting.
• Privileges Required: Low — an authenticated low-privileged user (e.g., monitoring user) can trigger the vulnerability.
• User Interaction: Required — a victim must view the polluted Map.
• Scope: Changed — the vulnerable component (Maps rendering code) is impacted differently than the security authority (the victim's browser session/privileges).
• Confidentiality Impact: Low — limited data exposure (session tokens, limited map data).
• Integrity Impact: Low — attacker can modify content/state in the victim's browser context.
• Availability Impact: None.

Business Impact:

• Monitoring Infrastructure Compromise: Zabbix is the "eyes and ears" of IT operations. XSS in Maps can lead to configuration tampering, alerting disruption, or masking of real incidents.
• Credential and Data Exposure: Zabbix stores credentials for monitored systems and service integrations (via macros and media types). A session hijack on an admin user could expose these.
• Supply Chain / Downstream Risk: If Zabbix monitors customer-facing infrastructure, attackers could use it as an intelligence-gathering platform to identify high-value internal targets.
• Blast Radius: All authenticated users with Map access are potential victims. Multi-tenant Zabbix deployments (service providers) increase the number of affected organizations from a single attack.

Affected Systems: Zabbix deployments with the Maps feature enabled and a web frontend running a vulnerable version. Given the vendor has not disclosed exact version ranges, all recent Zabbix versions should be considered potentially vulnerable until patch confirmation.

Detection Guidance

Sigma Rule

Detection of prototype pollution indicators in Zabbix HTTP requests:

title: Zabbix Prototype Pollution URL Parameter Exploitation
id: 2a3b1c5d-8e4f-4a6b-9c2e-1f3a4b5c6d7e
status: experimental
description: Detects URL parameters attempting prototype pollution against Zabbix web frontend searchParamsToObject() processing
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-23929
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
    - attack.t1059
    - attack.t1190
    - cve.2026.23929
logsource:
    category: webserver
    product: zabbix
detection:
    selection:
        http.url|contains:
            - '__proto__'
            - 'constructor[prototype]'
            - '.prototype.'
    condition: selection
level: high
falsepositives:
    - None expected in legitimate administrative traffic
    - Automated security scanners may trigger
fields:
    - source.ip
    - dest.ip
    - http.url
    - url.username
    - http.user_agent

YARA Rule

Detection of prototype pollution payloads in web traffic or log captures:

rule CVE_2026_23929_Zabbix_ProtoPollution_XSS
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-01-15"
        description = "Detects prototype pollution injection patterns targeting Zabbix searchParamsToObject() leading to persistent XSS in Maps"
        cve = "CVE-2026-23929"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-23929"
        severity = "high"
    strings:
        $proto1 = "__proto__" ascii
        $proto2 = "constructor[prototype]" ascii
        $proto3 = ".prototype." ascii
        $proto4 = "polluted" ascii
        $jq1 = "$(" ascii
        $jq2 = ".html(" ascii
        $jq3 = ".append(" ascii
        $dom1 = "onerror" ascii
        $dom2 = "onload" ascii
        $dom3 = "srcdoc" ascii
        $zabbix1 = "zabbix.php" ascii
        $zabbix2 = "searchParamsToObject" ascii
    condition:
        (uint16(0) == 0x3C3F or uint16(0) == 0x3C21 or filesize < 2MB) and
        (1 of ($proto*) or $zabbix2) and
        (any of ($jq*) or 1 of ($dom*)) and
        1 of ($proto*)
}

Suricata IDS Rule

alert http any any -> any any \
msg:"CVE-2026-23929 Zabbix Prototype Pollution attempted via URL parameters"; \
flow:established,to_server; \
http.uri; \
content:"__proto__"; \
http.uri; content:"zabbix"; \
http.uri; content:".php"; \
classtype:web-application-attack; \
sid:2026023929; rev:1; \
reference:cve,2026-23929; \
reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-23929;

Elastic Detection

EQL query to detect prototype pollution URL parameters against Zabbix in web server logs:

// Elastic EQL query — run against web access logs (filebeat-* or logs-* indices)
sequence by source.address, url.domain
  with maxspan = 5m
  [network where
      network.protocol == "http" and
      url.path like "*zabbix*" and
      (url.query contains "__proto__" or
       url.query contains "constructor[prototype]" or
       url.query contains ".prototype.")]
  [any where true]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=zabbix
| where match(uri_query, "(?i)(__proto__|constructor%5Bprototype%5D|\\.prototype\\.)")
| search uri_path="*zabbix*"
| eval attack_signal="CVE-2026-23929_ProtoPollution"
| eval threat_score=case(
    match(uri_query, "(?i)onload|onerror|srcdoc"), 100,
    true(), 60)
| table _time, src_ip, dest_ip, dest_port, uri_path, uri_query, user,
        http_user_agent, attack_signal, threat_score
| sort - threat_score, _time

Wazuh OSSEC Rule

<group name="web,attacks,zabbix,">
  <rule id="100239" level="15">
    <decoded_as>web</decoded_as>
    <field name="url" type="pcre2">(?i)(__proto__|constructor%5Bprototype%5D|\.prototype\.)</field>
    <description>CVE-2026-23929: Zabbix prototype pollution API parameter probing from IP $(srcip)</description>
    <group>attack.t1190,attack.t1059,</group>
    <mitre>
      <id>T1190</id>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. NVD lists a patch as available, but it has not been independently confirmed. Specific patched versions are NOT disclosed. Verify patch availability directly from Zabbix.

Immediate Mitigations (compensating controls until patch applied/verified):

1. Restrict Map Access: Review and limit which user roles/groups have access to the Maps feature. Disable map access for low-privilege users if not business-required.
2. Web Application Firewall (WAF) Rules: Deploy WAF rules to block URL parameters containing __proto__, constructor[prototype], or .prototype. patterns targeting the Zabbix web frontend.
3. Network Segmentation: Restrict access to the Zabbix web frontend to trusted networks/VPNs. Do not expose Zabbix to the public internet.
4. Session Monitoring: Enable enhanced audit logging; implement monitoring for repeat View Map activity by a single user (indicative of reconnaissance).

Patch/Upgrade Steps:

1. Monitor the official Zabbix security advisory page and release notes for the CVE-2026-23929 fix.
2. Upon patch release, upgrade Zabbix server and all web frontend instances in a staged manner (test → staging → production).
3. Verify the patch version number and integrity (checksum) before deployment.
4. If using a Linux distribution package (e.g., apt/dnf), apply the update through official distribution repositories when available.

Long-Term Hardening:

1. Enable Two-Factor Authentication (2FA) for all Zabbix user accounts to reduce risk from session hijacking/theft.
2. Adhere to least-privilege for Zabbix roles; regular users should not have Map modification rights.
3. Keep jQuery and all frontend libraries current; subscribe to Zabbix security announcements.
4. Audit Maps configuration for unexpected markers/labels that may indicate a prior successful XSS injection.
5. Log and correlate access to Maps with failed login or other suspicious activity to detect post-exploitation lateral movement.

References

1. NVD Entry for CVE-2026-23929 — https://nvd.nist.gov/vuln/detail/CVE-2026-23929
2. CWE-1321: Improperly Controlled Modification of Object Prototype Attributes — https://cwe.mitre.org/data/definitions/1321.html
3. Zabbix Official Security Advisories (verify patch status) — https://www.zabbix.com/security_advisories
4. MITRE ATT&CK Technique T1059: Command and Scripting Interpreter — https://attack.mitre.org/techniques/T1059/
5. MITRE ATT&CK Technique T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

Exploit-in-the-Wild / Threat Actor Activity: As of the report publication, CVE-2026-23929 is NOT listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. There are no documented threat actor campaigns specifically targeting this CVE. However, a public exploit exists, which lowers the bar for less sophisticated attackers to weaponize the flaw if they gain authenticated access to a Zabbix instance. Given Zabbix's prevalence in enterprise monitoring environments, monitoring for exploitation attempts is warranted even absent current in-the-wild evidence.