CVE-2026-23937

Executive Summary

CVE-2026-23937 is an unpatched information-disclosure vulnerability in the Zabbix monitoring platform's API. Authenticated users can abuse the host.get API action to extract a host's PSK (pre-shared key), which directly undermines the confidentiality of the encrypted agent-to-server channel and can lead to a loss of data integrity. The vendor, affected version range, and CVSS score are not currently disclosed; no public exploit, CISA KEV listing, or patch is available at the time of writing.

Technical Analysis

The vulnerability resides in the Zabbix API layer, specifically the host.get action. Zabbix uses PSK keys to authenticate and encrypt communications between Zabbix agents and the Zabbix server/proxy. In a correctly configured deployment, these key values are highly privileged secrets that should only be retrievable by administrative accounts. The NVD description states that "authenticated users" — without requiring full administrator privileges — can exploit host.get to extract a host's PSK key.

At a functional level, host.get is an API method that returns host configuration objects. The flaw class is consistent with an authorization/access-control failure in which the API response includes sensitive key material (the PSK) that the requesting principal is not entitled to receive. Because the request is made through the standard API by a validly authenticated user, traditional network-layer defenses are ineffective; the failure occurs at the application authorization layer and is masked by the fact that the request itself is legitimate within the API's schema. The NVD has assigned CWE-203 (Observable Discrepancy), indicating that the API's observable response behavior reveals internal state — in this case, the inclusion of PSK key material in an API response — in a way that allows an authenticated user to learn secrets beyond their authorization boundary.

The attack surface is any Zabbix API endpoint that accepts authenticated requests from lower-privileged user accounts. The Zabbix web interface and API are commonly exposed to internal networks and, in misconfigured deployments, to the internet via Shodan-discoverable instances. Because the data is served through a legitimate API call, the disclosure may go unnoticed in standard access logs: the request is successful (HTTP 200), originates from a valid authenticated session, and contains no shellcode or obfuscation.

Technical detail is limited. The NVD description does not specify which API version, which exact API request parameters, or which Zabbix release lines are affected, nor does it identify the minimum privilege level required. The vendor has not published a CNA title, advisory, or version range. Insufficient technical detail is available to name the specific request parameters or response fields beyond the host.get action and the PSK key material itself.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance and target identification. An attacker with valid low-privileged Zabbix credentials (obtained via credential stuffing, phishing, or insider access) identifies the Zabbix server's API location and version. Internet-exposed Zabbix instances can be discovered through Shodan dorks such as title:"Zabbix" or product:Zabbix.

2. Triggering the flaw. The attacker authenticates to the Zabbix API using their low-privileged account and invokes the host.get action. No privilege escalation or authentication bypass is required — the vulnerability is that the API serves sensitive PSK key material to this authenticated principal.

3. Execution method (vulnerability-class level). The attacker crafts a standard API request invoking host.get. Because the flaw is in the API's authorization/response logic rather than in input validation, no injection payload is required; the request is structurally valid and is processed normally by the server. The server's response contains PSK key material associated with one or more monitored hosts.

4. Post-exploitation impact. With the extracted PSK key, the attacker can impersonate a monitored host toward the Zabbix server, establish a rogue agent that injects fabricated monitoring data, or potentially intercept and decrypt agent-server traffic where PSK encryption is in use. This leads directly to the "loss of data integrity" identified in the NVD description: the monitoring data stream can no longer be trusted, and incident responders may be fed false telemetry.

The exploitation requires no network manipulation and no brute force, making it quiet and difficult to distinguish from routine administrative API usage.

Impact Assessment

The business impact of CVE-2026-23937 is concentrated on the integrity of monitoring data and the confidentiality of cryptographic material. Zabbix is a core observability component in many enterprise environments; organizations rely on it for availability monitoring, trigger-based alerting, and incident triage. A compromise of PSK material enables an attacker to forge agent data, suppress real alerts by sending "healthy" metrics, or emit misleading alarms to degrade or redirect security operations.

The blast radius extends to every host whose PSK is managed by the affected Zabbix instance. Because PSK keys are typically reused per-host but may be reused across hosts in some deployments, a single host.get extraction could expose multiple monitored endpoints. The affected systems are the Zabbix server/proxy API, and the downstream trust chain includes all agents configured with the exposed PSK.

CVSS and EPSS scoring are not available (CVSS: N/A; EPSS not yet scored), so a quantitative severity rating cannot be assigned. Qualitatively, the requirement for authentication reduces exposure, but the unpatched status, the sensitivity of the disclosed material, and the data-integrity outcome elevate the risk for any organization running Zabbix with network-exposed APIs and broad user provisioning. There is no evidence of exploitation in the wild and no CISA KEV listing at the time of writing.

Detection Guidance

The following detection content targets API request/response patterns and log events involving the host.get action in conjunction with PSK key material. Tune false positives for environments where administrative API usage of host.get is routine.

Sigma Rule

title: Zabbix API host.get PSK Key Extraction Attempt
id: 4f6d1c62-8a5e-4b3a-9c2d-7e1f0a3b8d21
status: experimental
description: Detects web server access log entries indicating Zabbix API host.get calls that may expose PSK key material to authenticated users.
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-uri-query|contains:
      - "host.get"
    cs-uri-query|contains:
      - "PSK"
      - "psk"
  condition: selection
fields:
  - c-ip
  - cs-username
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate Zabbix administrators retrieving host configuration with PSK material
level: high

YARA Rule

rule zabbix_host_get_psk_extraction
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects log or packet captures containing Zabbix host.get API calls referencing PSK key material"
        date = "2026-02-07"
        cve = "CVE-2026-23937"
    strings:
        $a = "host.get" ascii wide nocase
        $b = "PSK" ascii wide
        $c = "psk" ascii wide
        $d = "jsonrpc" ascii wide nocase
    condition:
        $a and ($b or $c) and #d < 5
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET TROJAN Zabbix API host.get PSK Exfiltration Attempt"; flow:established,to_server; http.request_body; content:"host.get"; nocase; http.request_body; content:"PSK"; nocase; classtype:attempted-recon; sid:2026239; rev:1; metadata:created_at 2026_02_07, cve CVE-2026-23937;)

Elastic Detection

any where http.request.body.text like "*host.get*" and
      (http.request.body.text like "*PSK*" or http.response.body.text like "*PSK*")

Splunk SPL Query

index=* ("host.get" AND "PSK")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, http_method, uri, status
| where status = 200
| sort - last_seen

Wazuh OSSEC Rule

<group name="zabbix,">
  <rule id="100239" level="12">
    <decoded_as>json</decoded_as>
    <match>host.get</match>
    <match>PSK</match>
    <description>Zabbix API: host.get response containing PSK key material (CVE-2026-23937)</description>
    <group>zabbix,credential_access,exfiltration,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — the vulnerability is UNPATCHED as of this report; no vendor advisory, hotfix, or fixed release has been identified in any tracked source. The following steps are recommended immediately:

1. Immediate mitigations:

   • Restrict network access to the Zabbix API to trusted management subnets only; disable internet exposure of the API surface.
   • Audit all Zabbix user accounts and review their permissions. Where possible, revoke API access from low-privileged accounts and ensure only administrators can invoke host.get.
   • If the Zabbix role model supports field-level or action-level permissions, configure it to deny host.get to any role that does not explicitly require host configuration retrieval.
   • Rotate all PSK keys for hosts managed by the affected environment as a precautionary measure; PSK material may already be exposed in environments. Monitor for anomalous agent connections or duplicate agent identities after rotation.
   • Enable and retain Zabbix API audit logs; alert on successful host.get calls originating from non-administrator users.

2. Patch/upgrade steps:

   • No patch is currently available. Monitor the Zabbix security advisories page and the NVD entry for CVE-2026-23937 for vendor updates.
   • Plan for an emergency maintenance window to apply the vendor fix once released; test the fix in a staging environment before production deployment due to the central role of the Zabbix API.

3. Long-term hardening:

   • Adopt a secrets-management approach for Zabbix PSK material — store keys outside the API's default response schema wherever the deployment supports it, and treat PSK values as sensitive credentials.
   • Enforce multi-factor authentication for Zabbix API and web console accounts, and integrate Zabbix authentication with the enterprise identity provider to enable rapid account revocation.
   • Segment Zabbix servers from general user networks, and apply a default-deny firewall policy for management interfaces.
   • Incorporate Zabbix API calls into a baseline of legitimate behavior in the SIEM so that anomalous host.get usage by non-admin accounts triggers alerting.

References

1. NVD Entry: CVE-2026-23937 — https://nvd.nist.gov/vuln/detail/CVE-2026-23937 (NVD Description and CWE-203 assignment)
2. Zabbix Official Website — https://www.zabbix.com (product context, API and PSK documentation)
3. Zabbix Security Advisories — https://support.zabbix.com/browse/ (pending vendor advisory; no advisory published as of this report)
4. MITRE ATT&CK: T1213 — Data from Information Repositories — https://attack.mitre.org/techniques/T1213/ (tactic mapping for API-based key extraction)
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-23937 is NOT currently listed; no known exploitation in the wild)

Threat actor campaigns / exploit-in-the-wild evidence: None identified. No public exploit code, Nuclei template, or PoC has been released, and the vulnerability is not listed in CISA KEV as of this report date.