A vulnerability has been discovered within Zabbix front end which if configured with SAML could allow a remote unauthenticated attacker to exploit this issue in order to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
Affected Version
Zabbix 5.4.0 – 5.4.8, 6.0.0alpha1
Fixed Version
Zabbix 5.4.9rc2, 6.0.0beta1
Remediation
To remediate this vulnerability, apply the updates listed in the ‘Fixed Version’ section to appropriate products or if an immediate update is not possible, follow the presented below workarounds.
Workaround
Where immediate patching is not possible it is possible to remediate this issue by disabling SAML authentication. Please be aware of the side effects of disabling SAML before performing this action if you rely on SAML for authentication.
References
Why a vulnerability research agent has to look beyond one file
A weakness that looks convincing in one file can vanish once you see the whole application. Luke Potter explains how the Swarm keeps an AI lead…
CovertSwarm named a Sample Vendor for Agentic Red Teaming in the Gartner® Emerging Tech Impact Radar: Preemptive Cybersecurity
The question for security leaders is who’s in charge of the agents that test their defenses. We think it should be ethical hackers. That’s how we’re…
Security by obscurity is dead.
On June 18, 2026, an OpenAI agent got into the Medicare statistics reporting service portal run by Services Australia. ABC News describes it as a legacy…