Zabbix 7.0.16 → 7.0.26
10 releases · 0 breaking changes · 12 security fixes · 12 advisories fixed
12security0breaking0deprecated26feature95fix
Vulnerabilities fixed by this upgrade
- 5.4 CVE-2026-23929 Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…
- 6.8 CVE-2026-23928 The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…
- 6.5 CVE-2026-23927 A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…
- 6.8 CVE-2026-23926 An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…
- 8.8 CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
- 4.9 CVE-2026-23924 Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
- 6.0 CVE-2026-23919 For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no…
- 8.8 CVE-2026-23920 Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
- 8.1 CVE-2026-23925 An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
- 4.3 CVE-2025-49641 A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
- 4.9 CVE-2025-27231 The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
- 6.5 CVE-2025-27236 A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h…
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu… in 7.0.25
- security Fixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac… in 7.0.24
- security Fixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato… in 7.0.24
- security Fixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat… in 7.0.24
- security Fixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary… in 7.0.23
- security Fixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth… in 7.0.22
- security Fixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected… in 7.0.22
- security Fixes CVE-2026-23919: For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no… in 7.0.19
- security Fixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori… in 7.0.18
- security Fixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now… in 7.0.18
- security Fixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. in 7.0.18
- security Fixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h… in 7.0.17
Every release in between
feature[ZBXNEXT-9722] added authentication macros to Redis by Zabbix agent 2 template (smansurovs)
feature[ZBXNEXT-10502] added support for native connection mode in Ceph by Zabbix agent 2 template (abakaldin)
feature[ZBXNEXT-10211] added info about VMware entities to alarm JSON and ifbackingnetwork info to JSON for *vm.discovery and *vm.net.if.discovery items (MVekslers)
fix[ZBX-27496] improved network discovery subsystem to work with snmpv1 and snmpv2c checks (MVekslers)
fix[ZBX-27635] fixed Zabbix server and proxy build without libcurl (arimdjonoks)
fix[ZBX-27592] fixed memory items becoming unsupported in Apache templates (kflorowski)
fix[ZBX-17971] fixed macro view in trigger descriptions in some SNMP templates (abrosimovs)
fix[ZBX-27610] fixed http agent item user macros not resolving in required status codes (kastafjevs)
fix[ZBX-26388] improved memory usage monitoring for Docker by Zabbix agent 2 template (smansurovs)
fix[ZBX-27115] fixed some ODBC errors not being processed (mkorotkov)
fix[ZBX-27025] fixed incorrect header parsing in JS files (kflorowski)
fix[ZBX-27485] fixed issue with disabled toggling and readonly attributes in "Access to API" section (msnihach)
fix[ZBX-27418] fixed "disk failed" status in HPE Primera by HTTP template (smansurovs)
fix[ZBX-27611] reduced received data size for Elasticsearch template (kflorowski)
fix[ZBX-27552] fixed macro descriptions in Azure template (kflorowski)
fix[ZBX-27569] fixed broadcasting of item in Item history widget (dfofanovs)
securityFixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…
feature[ZBXNEXT-10121] added support for PHP 8.5 (talbergs)
feature[ZBXNEXT-10553] updated maximum supported TimescaleDB version to 2.26 (mprihodko)
feature[ZBXNEXT-10448] updated maximum supported MySQL version to 9.6 (mprihodko)
feature[ZBXNEXT-10422] added Cradlepoint NCM v2 by HTTP and Cradlepoint NCM v2 device by HTTP templates (aiantsen)
feature[ZBXNEXT-9961] added webhook for IBM Maximo service request creation (abrosimovs)
feature[ZBXNEXT-10477] updated maximum supported MariaDB version to 12.2 (mprihodko)
fix[ZBX-28068] fixed property name handling in JavaScript objects (averza)
fix[ZBX-27662] renamed GLPI media type (mruszczyk)
fix[ZBX-27542] fixed memory leak in Zabbix Agent 2 scheduler (mkorotkov)
fix[ZBX-27179] fixed incorrect man page for Zabbix agent 2 (dbriedis)
fix[ZBX-26341] fixed hint-box disappearing on refresh in problems (gklavins)
fix[ZBX-27044] fixed inconsistent focus and selection of primary fields in forms (averza)
fix[ZBX-27056] enabled displaying setting links in top drop-down menu for custom UI modules (aluchko)
fix[ZBX-27582] fixed history syncer being blocked when checking if new timers are added or updated (vso)
fix[ZBX-27147] added RESTful API v2 support with OAuth2 and updated endpoints in GLPi media type (mruszczyk)
fix[ZBX-27626] fixed crash during configuration sync after removing prototype trigger with non-prototype item (wiper)
fix[ZBX-26128] fixed sort order for problem and event acknowledgements to use ID for same timestamp records (gberzina, rgontarski)
fix[ZBX-27108] fixed issue where graph time selector caused full page refresh and lost current pagination (msnihach)
fix[ZBX-27058] fixed unsupported items in HPE iLO by HTTP (kflorowski)
fix[ZBX-25988] fixed problem with multiple columns being created on column create in widgets (wczerneha)
fix[ZBX-26931] fixed service list to display inaccessible service error when opening or refreshing list of deleted services (gberzina)
fix[ZBX-27584] improved configuration sync performance on Zabbix proxy by deleting in batches (vso)
fix[ZBX-27312] fixed issue of Zabbix agent 2 sometimes returning wrong result for proc.num (arimdjonoks)
fix[ZBX-26899] fixed yaml markings for import compare (gberzina)
fix[ZBX-26979] fixed issue causing empty error message when adding new template group to template (msnihach)
fix[ZBX-26542] fixed max period calculation method for graphs in parameter validation for allowed period (msnihach)
fix[ZBX-27306] added optional upgrade patch to ensure that web scenario item tags correspond to web scenario tags (arimdjonoks)
securityFixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…
securityFixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…
securityFixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…
fix[ZBX-27590] reverted the custom-on-fail discard value behavior so that it now correctly discards the value instead of resetting the error state and recalculating dependent items (vso)
fix[ZBX-26579] added possibility to switch SSO user on internal login failures (jfreibergs)
securityFixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
fix[ZBX-27387] fixed deadlock during auto registration and SQLite (vso)
securityFixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
securityFixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
fix[ZBX-27639] fixed regexp input validation to match whole input instead of per line match (askolmeisters)
fix[ZBX-27153] fixed undefined index error in SVG graphs for Zabbix agent active items (gcalenko)
fix[ZBX-27156] fix CPU spike in Zabbix agent 2 mysql plugin (esneiders)
feature[ZBXNEXT-10271] updated maximum supported TimescaleDB version to 2.22 (mprihodko)
feature[ZBXNEXT-10245] added Stormshield SNS by SNMP template (knaglis)
feature[ZBXNEXT-10219] updated maximum supported PostgreSQL version to 18 (mprihodko)
feature[ZBXNEXT-7744] added TLS support for Zabbix agent 2 Redis plugin (opucka)
fix[ZBX-27113] improved performance and memory usage by not storing item unsupported error in configuration cache (vso)
fix[ZBX-27111] fixed new timer being allocated each time trigger value is updated (vso)
fix[ZBX-26544] added preprocessing step to "Outbound packets discarded" item in FortiGate by SNMP template (aiantsen)
fix[ZBX-22157] added Map navigation tree widget problem filtering using "Problem display" and "Show suppressed problems" filters of map settings (dfofanovs)
fix[ZBX-27059] fixed conditions for "Cannot delete default MFA method" check (dpankins)
fix[ZBX-24504] improved Prometheus to JSON preprocessing step performance when reused with similar parameters in dependent items (wiper)
fix[ZBX-25743] fixed broken item selection list in Firefox (gklavins, wczerneha)
fix[ZBX-25148] added adjustments for sequential data entries with the same timestamp (askolmeisters)
fix[ZBX-25394] fixed unassigned proxy indication on Queue details page; extended coverage to proxies managed by proxy groups (dpankins)
fix[ZBX-25263] fixed Zabbix agent to attempt next refresh of active checks in 60 seconds in case of connection errors (arimdjonoks)
fix[ZBX-26910] fixed Zabbix server and Zabbix proxy compilation on macOS or with custom library paths (vso)
fix[ZBX-25741] eliminated difference in host group lists via "Select" button and via search typing (wczerneha)
fix[ZBX-26941] fixed duplicate entry error when new value arrive after Zabbix server finished syncing trends (vso)
fix[ZBX-26893] fixed delay when executing tasks through Zabbix proxy such as test item, check now, remote command (vso)
fix[ZBX-26459] fixed Host macros view to avoid displaying both macro types when switching quickly (gberzina)
fix[ZBX-26776] fixed ability to change widget in Pie chart widget data set (gberzina)
fix[ZBX-22625] fixed JavaScript in HPE Synergy by HTTP template (abrosimovs)
fix[ZBX-26069] implemented re-broadcast behavior for widgets on forced update (ashubin, wczerneha)
fix[ZBX-24918] fixed crashes of Zabbix agent 2 for Windows related to PDH perf_counter (opucka)
fix[ZBX-26755] fixed problem with Zabbix agent 2 MQTT plugin not establishing connection if first call failed (opucka)
fix[ZBX-16162] fixed classic graphs rendering when throttling is used (Sasha)
fix[ZBX-24046] fixed incorrect error message for ldap_jit_interval field in LDAP settings form (kkuzmina)
fix[ZBX-25038] fixed SCIM error message by adding mention of requested endpoint to it (kkuzmina)
fix[ZBX-26851] changed macro names in MSSQL templates (sbelakovs)
securityFixes CVE-2026-23919: For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no…
feature[ZBXNEXT-10143] added "Highlight whole row" feature in non-compact mode in Problems (ashubin)
feature[ZBXNEXT-10106] extended preprocessor throughput monitoring in Zabbix server/proxy health templates (aiantsen)
feature[ZBXNEXT-9819] added new template Vyatta Virtual Router by SNMP (knaglis)
feature[ZBXNEXT-9933] added TNS name support for Zabbix agent 2 Oracle plugin (lsurvilo)
feature[ZBXNEXT-10107] improved device coverage in Huawei OceanStor Dorado by SNMP template (abrosimovs)
feature[ZBXNEXT-10123] added Aruba CX 8300s by SNMP template (akotsegubov)
feature[ZBXNEXT-10152] added new macro for disk discovery type selection in both SMART by Zabbix agent 2 templates (knaglis)
feature[ZBXNEXT-10027] prepared for removal of TimescaleDB API call deprecated since TimescaleDB 2.18.0 (jfreibergs)
feature[ZBXNEXT-10017] added Ciena 3906 by SNMP template (akotsegubov)
feature[ZBXNEXT-9255] updated Meraki templates to handle rate limit on API requests (aiantsen)
feature[ZBXNEXT-9902] changed timeout range for Zabbix JS and Zabbix get utilities (askolmeisters)
feature[ZBXNEXT-10077] updated maximum supported MariaDB version to 12.0 (mprihodko)
fix[ZBX-26419] improved performance of problem and event views by optimizing SQL queries to join only necessary triggers, eliminating redundant post-join filtering (vso)
fix[ZBX-25796] fixed confusing error message on item test timeout (isharha)
fix[ZBX-26337] removed unnecessary div elements for entries without problems in Item and Host navigator widgets (msnihach)
fix[ZBX-26873] fixed support for SSH item proxy through configurations in SSH configuration file (aetatsu)
fix[ZBX-19267] fixed wmi.get items sometimes incorrectly returning "Empty WMI search result" with Zabbix agent 2 (aetatsu)
fix[ZBX-20207] fixed unexpected interface connection mode change during autoregistration (vso)
fix[ZBX-25448] fixed token-based authentication method in FortiGate by HTTP template (egordymov)
fix[ZBX-26847] explicitly defined Oracle connection timezone in Zabbix agent 2 (opucka)
fix[ZBX-26472] fixed clearing of elements when imported file contains no background image or icon map (rgontarski)
fix[ZBX-26694] fixed media type test parameter maxlength (gberzina)
fix[ZBX-26416] fixed SNMP trap item processing issue after monitored host changes (sboidenko)
fix[ZBX-26801] fixed ability to select discovered items when editing graph items (gberzina)
fix[ZBX-20964] removed Problems link in Monitoring hosts page for user who does not have access (msnihach)
fix[ZBX-26621] added TLS host parameter update in autoregistration mode (vsmelovs)
fix[ZBX-26440] fixed inability to update JMX endpoint field in item, item prototype, and LLD forms (kkuzmina)
fix[ZBX-25041] improved configuration form validation in Graph and Pie chart widgets when referenced item widget is unavailable (isharha)
fix[ZBX-24720] fixed LDAP media type mapping "When active" field trimming (dpankins)
fix[ZBX-26892] fixed VMware Event Collector hangs in case of network errors (MVekslers)
fix[ZBX-26920] fixed wrong time in Zabbix agent for Windows (sboidenko)
fix[ZBX-25669] added trigger version check after upgrading to newer version (aluchko)
fix[ZBX-22786] fixed trends graph line color issue with PHP 8.1 (isharha)
fix[ZBX-26044] fixed Honeycomb widget not to display disabled items (rgontarski)
fix[ZBX-25540] fixed inconsistent link styling for dependent trigger prototypes (rgontarski)
fix[ZBX-26482] fixed TypeError after deleting datasets in Graph and Pie chart widgets (isharha)
fix[ZBX-26202] fixed inability to create "Execute now" tasks for users of Admin user type (jfreibergs)
fix[ZBX-24603] fixed MFA TOTP secrets not being deleted when deleting users from MFA-enabled user groups (agriscenko, jfreibergs)
fix[ZBX-25739] fixed timeleft() function to return 1.7976931348623157E+308 instead of making item unsupported in case of infinite time (arimdjonoks, averza)
+11 more items in the release notessecurityFixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
securityFixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
securityFixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
fix[ZBX-26868] fixed crash when adding new SNMP device (vso)
securityFixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h…
feature[ZBXNEXT-10119] improved preprocessing diagnostics by highlighting top item IDs with the longest processing times (vso)
fix[ZBX-26693] fixed high memory usage by excluding values without preprocessing from being sent to the preprocessing manager (vso)
fix[ZBX-26661] fixed deadlock on autoreg_host table (vso)