Zabbix: SQL injection in API sortfield parameter (CVE-2026-23921)

CVE-2026-23921 is a time-based blind SQL injection vulnerability in the Zabbix API. The flaw exists in CApiService::applyQuerySortOptions() where a failure to properly validate the sortfield parameter when combined with a user-supplied groupBy array allows for SQL injection. Attackers can provide a malicious payload that reaches the ORDER BY clause of SQL queries without sanitization. The vulnerability affects Zabbix versions prior to 7.0.22, 7.2.15, and 7.4.6. Public exploit code is available.

Attack Chain

1. Attacker authenticates to the Zabbix API using a valid user account.
2. Attacker invokes an API method such as host.get, trigger.get, or item.get.
3. Attacker injects a payload into the groupBy parameter and the sortfield parameter.
4. The zbx_array_merge() function merges the attacker-controlled groupBy into the options array.
5. CApiService::applyQuerySortOptions() validates the sortfield using the attacker-controlled groupBy input, effectively bypassing the whitelist.
6. The createSelectQueryFromParts() function generates the final SQL query containing the unsanitized ORDER BY clause.
7. The database executes the injected SQL, allowing for time-based data exfiltration via pg_sleep() or equivalent functions.

Impact

Successful exploitation allows for blind, time-based data exfiltration from the underlying database (PostgreSQL or MySQL). An attacker must have valid API credentials to reach the vulnerable code path.

Recommendation

• Upgrade Zabbix immediately to version 7.0.22, 7.2.15, 7.4.6, or higher to receive the patch that replaces array_merge with array_intersect for input validation.
• Audit Zabbix API access logs for anomalous sortfield or groupBy usage patterns.
• Restrict access to the Zabbix API to authorized IP addresses or internal networks.