CVE-2026-23933 affects Zabbix 7.4.0 through 7.4.10. The key that signs frontend sessions was written into the database seed, so it was not unique to each install. Zabbix says the only known exploit case is SAML authentication combined with guest users, where cookies could be forged. Version 7.4.11 fixes it.
What's affected
Zabbix 7.4.0 through 7.4.10, fixed in 7.4.11, per the Zabbix issue ZBX-28071. The NVD score is 9.1, and Zabbix rates it 7.7 using CVSS 4.0 with an adjacent network vector. The Zabbix issue says that for deployments that do not use both SAML authentication and the guest user, there is no known impact.
How to check if you're exposed
Check the version in the frontend footer or with the server binary:
zabbix_server -V
Then check two settings in the frontend: whether SAML authentication is enabled, and whether the guest user is enabled with any access. Having both is the known risky combination.
What to do now
- Upgrade Zabbix to 7.4.11 or later. Zabbix says the upgrade patch removes the session key from the database.
- If you cannot upgrade yet, the vendor workaround is to clear the pre-seeded session key value in the settings table of the Zabbix database, which makes the frontend generate a new random key. Use the exact wording in ZBX-28071.
- If SAML and guest users are both enabled, consider disabling guest access until you are patched.
- Treat existing frontend sessions as suspect if you ran the risky combination, and invalidate them after the key changes.
Why it matters
The weakness is CWE-259, use of a hard-coded password, and here it applies to a signing key. A secret that is the same in every installation is public knowledge to anyone who can read the seed data.
The difference between the two scores shows how context changes severity. The exposure depends on a specific configuration, so check yours instead of assuming either the headline number or the vendor number applies. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 9.1, published 2026-08-18. In the vector, the attacker works over the network, needs no account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability no.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Hardening beyond the patch
Secrets that ship in seed data or default configuration are easy to miss because they look like settings. After the upgrade, check that your frontend session signing key is not an empty or known value, and that new installs generate their own. Restrict the Zabbix frontend to the networks that need it, and review whether guest access is needed at all. If you use SAML, review the identity provider settings and session lifetimes while you are in there.
Quick check
I do not use SAML. Am I safe?
Zabbix says it knows of no impact for deployments that do not use SAML together with guest users. Upgrading is still recommended because the key should not be in the seed.
Sources
Last reviewed: 19 October 2026.
