Live › vulnerability › CVE-2022-23131
Go to dashboardZabbix Frontend trusts client-side session data when SAML single sign-on is configured, so an attacker can forge a session and log in without credentials. A successful bypass lets the attacker take over the Zabbix instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Zabbix Frontend | vendor | – | – |
Check whether SAML authentication is enabled under Administration > Authentication in the Zabbix web UI.
Upgrade Zabbix Frontend to a fixed version per vendor instructions; the sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
This page as .md · .json · in your agent: get_signal("CVE-2022-23131")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.