CVE-2025-27231

The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.

Score

CVSS 3.1 4.9 Medium

Status

Analyzed - security@zabbix.com

Published

2025-10-03

Last modified

2026-10-19

Weaknesses

CWE-522

Affected products

• Zabbix (Zabbix)

References

• https://support.zabbix.com/browse/ZBX-27062