CVE-2026-23937

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key, leading to potential loss of data integrity.

An authenticated attacker could obtain the PSK key, potentially allowing them to impersonate hosts or compromise communication integrity, leading to unauthorized access or data manipulation.

Restrict API user permissions so only trusted individuals have access to host.get, and consider updating Zabbix to a version that fixes this vulnerability if available.