# CVE-2026-59785: Zabbix Frontend credential disclosure via search filtering

Source: https://junglewise.ai/threats/cve-2026-59785-host-search-in-frontend-allows-filtering-by-fields-that-are-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-59785 · Severity: info · Published 2026-10-05

Zabbix Frontend, a monitoring and alerting platform, allows authenticated users to search for hosts using filters on hidden credential fields including IPMI and pre-shared key (PSK) credentials. An attacker with read access can guess credentials one character at a time and verify guesses by observing search results, gradually uncovering stored credentials without requiring direct access to credential storage.

Technologies: [Zabbix](https://junglewise.ai/threats/technologies/zabbix). Vendors: [Zabbix](https://junglewise.ai/threats/vendors/zabbix).

## Quick answers

**Is CVE-2026-59785 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59785 being exploited in the wild.

**How severe is CVE-2026-59785?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Zabbix 6.0.0–6.0.47, 7.0.0–7.0.28, 7.4.0–7.4.12.

**Is there a fix for CVE-2026-59785?** Yes: fixed in 6.0.48, 7.0.29, 7.4.13. Until then: Update to the fixed versions: 6.0.48, 7.0.29, or 7.4.13 depending on your deployed version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59785 attacked?** It is attacked from the adjacent network, in a web application.

**Am I affected by CVE-2026-59785?** Check whether you run Zabbix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.0.48, 7.0.29, 7.4.13

Update to the fixed versions: 6.0.48, 7.0.29, or 7.4.13 depending on your deployed version.

## Technical details

The vulnerability exists in the Zabbix Frontend's multiselect.get filtering functionality, which allows search queries on host credential fields that are not displayed in the user interface (IPMI and PSK). An authenticated user with host read privileges can craft search queries to filter by these hidden fields; if a guess matches, the search result indicates the match, enabling credential enumeration through repeated guessing. This is an information disclosure vulnerability affecting the API-level host search implementation.

## Affected products

- Zabbix Zabbix 6.0.0–6.0.47, 7.0.0–7.0.28, 7.4.0–7.4.12

## Timeline

- 2026-10-05: disclosed: Advisory published

## References

- [https://support.zabbix.com/browse/ZBX-28195](https://support.zabbix.com/browse/ZBX-28195)

## Related threats

- [Zabbix stored XSS in OAuth configuration form](https://junglewise.ai/threats/cve-2026-59788-the-email-media-type-oauth-form-passes-the-authorization-endpoint)
- [Zabbix API PSK key extraction in host.get](https://junglewise.ai/threats/cve-2026-23937-zabbix-api-psk-key-extraction-in-host-get)
- [Zabbix Frontend denial of service via validate.api.exists](https://junglewise.ai/threats/cve-2026-23934-zabbix-frontend-denial-of-service-via-validate-api-exists)
- [Zabbix Frontend session key disclosure in database](https://junglewise.ai/threats/cve-2026-23933-zabbix-frontend-session-key-disclosure-in-database)
- [Zabbix Frontend plaintext macro value enumeration](https://junglewise.ai/threats/cve-2026-23931-zabbix-frontend-plaintext-macro-value-enumeration)