For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). (CVE-2026-23919)
Zabbix Server and Proxy reuse JavaScript (Duktape) contexts for performance, which can cause data leakage between users. Specifically, non-super administrators may access confidential data from hosts they are not authorized to view. A fix has been released that makes built-in JavaScript objects read-only, but global JavaScript variables remain risky and their use is discouraged.
AI Analysis
Technical Summary
Zabbix Server and Proxy reuse JavaScript (Duktape) contexts in features such as script items, JavaScript reprocessing, and Webhooks to improve performance. This reuse can lead to confidentiality loss by allowing regular (non-super) Zabbix administrators to leak data from hosts they do not have access to. The vendor has released a fix that makes built-in Zabbix JavaScript objects read-only to mitigate this issue. However, the use of global JavaScript variables is still not recommended because their content could be leaked across contexts.
Potential Impact
Confidentiality is impacted as unauthorized data leakage can occur between different Zabbix administrators due to shared JavaScript contexts. Integrity and availability impacts are lower but present as indicated by the CVSS vector. The vulnerability allows a privileged user with regular admin rights to access data beyond their permissions.
Mitigation Recommendations
A fix has been released that makes built-in Zabbix JavaScript objects read-only, mitigating the vulnerability. Users should update to the fixed version as per the vendor's guidance. Additionally, avoid using global JavaScript variables in scripts or preprocessing to prevent potential data leakage. Check the official Zabbix documentation for the latest remediation details.
For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). (CVE-2026-23919)
Description
Zabbix Server and Proxy reuse JavaScript (Duktape) contexts for performance, which can cause data leakage between users. Specifically, non-super administrators may access confidential data from hosts they are not authorized to view. A fix has been released that makes built-in JavaScript objects read-only, but global JavaScript variables remain risky and their use is discouraged.
CVSS v3.1
Score 6.0medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Zabbix Server and Proxy reuse JavaScript (Duktape) contexts in features such as script items, JavaScript reprocessing, and Webhooks to improve performance. This reuse can lead to confidentiality loss by allowing regular (non-super) Zabbix administrators to leak data from hosts they do not have access to. The vendor has released a fix that makes built-in Zabbix JavaScript objects read-only to mitigate this issue. However, the use of global JavaScript variables is still not recommended because their content could be leaked across contexts.
Potential Impact
Confidentiality is impacted as unauthorized data leakage can occur between different Zabbix administrators due to shared JavaScript contexts. Integrity and availability impacts are lower but present as indicated by the CVSS vector. The vulnerability allows a privileged user with regular admin rights to access data beyond their permissions.
Mitigation Recommendations
A fix has been released that makes built-in Zabbix JavaScript objects read-only, mitigating the vulnerability. Users should update to the fixed version as per the vendor's guidance. Additionally, avoid using global JavaScript variables in scripts or preprocessing to prevent potential data leakage. Check the official Zabbix documentation for the latest remediation details.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-h55g-ww3m-9hq9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-23919"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aade52a55bf5e2cf5edc1db
Added to database: 09/19/2026, 01:28:10 UTC
Last enriched: 09/19/2026, 01:55:56 UTC
Last updated: 09/19/2026, 02:01:26 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.