CVE-2026-23937 - Host PSK extraction in Zabbix API

MEDIUM

Host PSK extraction in Zabbix API

Published Aug 18, 2026

6.0

MEDIUM

CVSS 4.0

EPSS 0.27%

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Vendor solution

Update the affected components to their respective fixed versions.

Weaknesses (1)

CWE-203

Link	Providers	Tags
https://support.zabbix.com/browse/ZBX-28074

No recorded changes yet.

Sources

Status PUBLISHED

Assigner Zabbix

Published Aug 18, 2026

Updated Aug 18, 2026

Reserved Jan 19, 2026

Updated Aug 18, 2026

Status Analyzed

Modified Sep 23, 2026

Severity n/a

Public date n/a