CVE-2026-59785 — Hidden host credentials inferable via multiselect.get filtering

CVE-2026-59785

Hidden host credentials inferable via multiselect.get filtering PUBLISHED

Description (CNA)

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 6.0.0 through 6.0.47; affected 7.0.0 through 7.0.28; affected 7.4.0 through 7.4.12

CWE

CWE-204

References

https://support.zabbix.com/browse/ZBX-28195

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.