Zabbix bug bounty programs
zabbix.com Updated
Zabbix runs one public program: a HackerOne bug bounty paying up to $3,000 (paused).
- Top reward
- Not published
- Programs
- 1
- 1 pays cash
- Targets in scope
- 1
- 1 type
- Last change
- 1 Oct 2026
- 1 month ago
Where to report
The one public program Zabbix runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Zabbix
HackerOne · Bug bounty |
$3,000 | $1,500 | $500 | $200 | $3,000 | – | – | 11 hours average | Paused |
-
- Critical
- $3,000
- High
- $1,500
- Medium
- $500
- Low
- $200
- First response
- 11 hours average
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
1 target. 10 excluded.
-
https://www.zabbix.com/download_sources
Source code No bounty
No target matches. Try part of a host name, such as the company name.
Out of scope 10
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
https://academy.zabbix.com
-
https://blog.zabbix.com
-
https://cloud.zabbix.com
-
https://exam.zabbix.com
-
https://git.zabbix.com
-
https://shop.zabbix.com
-
https://space.zabbix.com
-
https://support.zabbix.com
-
https://translate.zabbix.com
-
https://www.zabbix.com
Recent changes
Reward and scope changes across every Zabbix program, newest first.
-
Paused
Paused. Not accepting reports right now.
Recent CVEs
Published vulnerabilities in Zabbix products, from the NVD.
-
CVE-2026-59781 Medium
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to d
-
CVE-2026-23933 High
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not ha
-
CVE-2026-23934 Medium
An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service.
-
CVE-2026-23935 Medium
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
-
CVE-2026-23937 Medium
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
-
CVE-2026-23938 Low
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
-
CVE-2026-1199 Medium
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.
-
CVE-2026-23922 Low
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.
About this page
This page gathers every public program listed under zabbix.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.