Bug 2545874 (CVE-2026-59786)
| Summary: | CVE-2026-59786 zabbix: zabbix: Host status spoofing via unauthenticated active agent heartbeats | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Zabbix. A remote, unauthenticated attacker with network access to the trapper port can spoof host availability, compromising the integrity of monitoring data. The Zabbix server and proxy accept active agent heartbeat messages without verifying configured pre-shared key (PSK) or certificate-based authentication, allowing an attacker to falsely report arbitrary hosts as available.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2545909 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-05 10:51:39 UTC
|