Zabbix 7.0.19 → 7.0.28
9 releases · 0 breaking changes · 12 security fixes · 12 advisories fixed
12security0breaking0deprecated18feature105fix
Vulnerabilities fixed by this upgrade
- 4.9 CVE-2026-23938 An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
- 5.4 CVE-2026-23929 Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…
- 7.5 CVE-2026-23930 An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…
- 4.9 CVE-2026-23935 A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
- 6.5 CVE-2026-23937 The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
- 3.7 CVE-2026-1199 Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…
- 6.8 CVE-2026-23928 The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…
- 6.5 CVE-2026-23927 A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…
- 6.8 CVE-2026-23926 An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…
- 8.8 CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
- 4.9 CVE-2026-23924 Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
- 8.8 CVE-2026-23920 Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. in 7.0.28
- security Fixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss. in 7.0.28
- security Fixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing… in 7.0.28
- security Fixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent… in 7.0.27
- security Fixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service. in 7.0.27
- security Fixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu… in 7.0.25
- security Fixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac… in 7.0.24
- security Fixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato… in 7.0.24
- security Fixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat… in 7.0.24
- security Fixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary… in 7.0.23
- security Fixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth… in 7.0.22
- security Fixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected… in 7.0.22
Every release in between
securityFixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
securityFixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
securityFixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…
feature[ZBXNEXT-10478] updated maximum supported MariaDB version to 12.3 (mprihodko)
feature[ZBXNEXT-10211] updated alarm discovery in vmware template (abakaldin)
feature[ZBXNEXT-10611] added real host name for native vmware.*.alarms.get item keys (MVekslers)
feature[ZBXNEXT-10618] updated maximum supported TimescaleDB version to 2.27 (mprihodko)
feature[ZBXNEXT-10592] updated maximum supported MySQL version to 9.7 (mprihodko)
fix[ZBX-28076] improved login handling (vbodrihins)
fix[ZBX-28074] fixed potential disclosure of some write-only fields through API filter and search parameters (dpankins)
fix[ZBX-28073] improved behavior of script HttpRequest call (MVekslers)
fix[ZBX-27495] fixed excessive history upload delay for both Zabbix agents (vsmelovs)
fix[ZBX-27883] fixed inability to copy trigger prototypes that depend on same trigger prototype when cloning template or host (vmaksimovs)
fix[ZBX-27900] fixed Windows job handle not being closed on Zabbix agent 2 (esneiders)
fix[ZBX-27594] fixed sorting of discovered hosts (msnihach)
fix[ZBX-27770] fixed validation of HTTP response data for scenario-level dynamic variables in web monitoring (sboidenko)
fix[ZBX-27561] mitigated recurring system errors when editing groups for users or hosts in parallel API requests (kkuzmina, mprihodko)
fix[ZBX-26766] fixed code error when updating host, template, or user groups with duplicate group set entries (jfreibergs)
fix[ZBX-27382] fixed incorrect tag-based service permission check (averza)
fix[ZBX-27200] fixed invalid statuses for hosts and services during network discovery when host is found on several IP addresses (aetatsu)
fix[ZBX-27144] fixed legend text clipping at bottom of downloaded widget images (aluchko)
fix[ZBX-27732] fixed auto refresh to continue running in Latest data view (uolekss)
fix[ZBX-26048] fixed long error title visibility in frontend modal window (isharha)
fix[ZBX-25461] fixed contrast problems with severity icons in high-contrast themes (kastafjevs)
fix[ZBX-26788] fixed duplicate announcement of month and year in datepicker for assistive technologies (aluchko)
fix[ZBX-27777] fixed dashboard widget decimals for Azure SQL Managed Instance by HTTP template (kbruvers)
fix[ZBX-27698] fixed Clock widget "Server time" displaying same time as browser local time (aluchko)
fix[ZBX-24054] fixed template cloning with extended amount of mappings (gklavins)
fix[ZBX-27809] fixed QR code generation by using integer pixel alignment to eliminate module distortion (gberzina)
fix[ZBX-27510] fixed Geomap widget not resizing map on container resize (averza)
securityFixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…
securityFixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
fix[ZBX-28075] fixed potential type mismatch in JS exception handling (MVekslers)
fix[ZBX-22504] improved memory usage in LLD worker processes with large low-level discovery (vso)
fix[ZBX-27780] restored support of LLD macros in LLD rule override operations Update interval, History, and Trends (dpankins)
fix[ZBX-27736] fixed no_data trigger flickering into unknown state for unsupported items (arimdjonoks)
fix[ZBX-27708] fixed error being displayed instead of graph for graphs with maximum height (kastafjevs)
fix[ZBX-27304] fixed missing gap between tag badges when widget overlay dialog is open (isharha)
fix[ZBX-25509] fixed z-select re-rendering after sorting (dpankins)
fix[ZBX-27210] fixed infinite loading on widgets after removing maps from Map Navigation Tree widget (aluchko)
fix[ZBX-27694] updated dependent item key from vm.memory.utilization to vm.memory.util in Linux by Zabbix agent active and passive templates (smansurovs)
fix[ZBX-27399] fixed possible deadlocks in configuration cache sync (sboidenko)
fix[ZBX-27675] improved configuration syncer not to reserve large amounts of memory (vso)
fix[ZBX-27475] fixed typo in Mattermost webhook "fallback" field name (smansurovs)
fix[ZBX-26742] fixed text overlap in pop-ups for Portuguese (gklavins)
fix[ZBX-27632] fixed trigger severity checkboxes update to checked state after validation error (kastafjevs)
fix[ZBX-27022] fixed preprocessing step "Discard unchanged" for string types (Andris, askolmeisters)
fix[ZBX-27688] removed checks to prevent bulk enabling of Gmail and Office 365 media types with incomplete configuration (aluchko)
fix[ZBX-27652] fixed incorrect documentation link for Administration/General/Other (aluchko)
fix[ZBX-27517] fixed "page not found" issue when exporting template that contains inaccessible dashboard element (aluchko)
fix[ZBX-27121] fixed issue where repeatedly clicking Close button on notifications floating pop-up caused error (msnihach)
feature[ZBXNEXT-9722] added authentication macros to Redis by Zabbix agent 2 template (smansurovs)
feature[ZBXNEXT-10502] added support for native connection mode in Ceph by Zabbix agent 2 template (abakaldin)
feature[ZBXNEXT-10211] added info about VMware entities to alarm JSON and ifbackingnetwork info to JSON for *vm.discovery and *vm.net.if.discovery items (MVekslers)
fix[ZBX-27496] improved network discovery subsystem to work with snmpv1 and snmpv2c checks (MVekslers)
fix[ZBX-27635] fixed Zabbix server and proxy build without libcurl (arimdjonoks)
fix[ZBX-27592] fixed memory items becoming unsupported in Apache templates (kflorowski)
fix[ZBX-17971] fixed macro view in trigger descriptions in some SNMP templates (abrosimovs)
fix[ZBX-27610] fixed http agent item user macros not resolving in required status codes (kastafjevs)
fix[ZBX-26388] improved memory usage monitoring for Docker by Zabbix agent 2 template (smansurovs)
fix[ZBX-27115] fixed some ODBC errors not being processed (mkorotkov)
fix[ZBX-27025] fixed incorrect header parsing in JS files (kflorowski)
fix[ZBX-27485] fixed issue with disabled toggling and readonly attributes in "Access to API" section (msnihach)
fix[ZBX-27418] fixed "disk failed" status in HPE Primera by HTTP template (smansurovs)
fix[ZBX-27611] reduced received data size for Elasticsearch template (kflorowski)
fix[ZBX-27552] fixed macro descriptions in Azure template (kflorowski)
fix[ZBX-27569] fixed broadcasting of item in Item history widget (dfofanovs)
securityFixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…
feature[ZBXNEXT-10121] added support for PHP 8.5 (talbergs)
feature[ZBXNEXT-10553] updated maximum supported TimescaleDB version to 2.26 (mprihodko)
feature[ZBXNEXT-10448] updated maximum supported MySQL version to 9.6 (mprihodko)
feature[ZBXNEXT-10422] added Cradlepoint NCM v2 by HTTP and Cradlepoint NCM v2 device by HTTP templates (aiantsen)
feature[ZBXNEXT-9961] added webhook for IBM Maximo service request creation (abrosimovs)
feature[ZBXNEXT-10477] updated maximum supported MariaDB version to 12.2 (mprihodko)
fix[ZBX-28068] fixed property name handling in JavaScript objects (averza)
fix[ZBX-27662] renamed GLPI media type (mruszczyk)
fix[ZBX-27542] fixed memory leak in Zabbix Agent 2 scheduler (mkorotkov)
fix[ZBX-27179] fixed incorrect man page for Zabbix agent 2 (dbriedis)
fix[ZBX-26341] fixed hint-box disappearing on refresh in problems (gklavins)
fix[ZBX-27044] fixed inconsistent focus and selection of primary fields in forms (averza)
fix[ZBX-27056] enabled displaying setting links in top drop-down menu for custom UI modules (aluchko)
fix[ZBX-27582] fixed history syncer being blocked when checking if new timers are added or updated (vso)
fix[ZBX-27147] added RESTful API v2 support with OAuth2 and updated endpoints in GLPi media type (mruszczyk)
fix[ZBX-27626] fixed crash during configuration sync after removing prototype trigger with non-prototype item (wiper)
fix[ZBX-26128] fixed sort order for problem and event acknowledgements to use ID for same timestamp records (gberzina, rgontarski)
fix[ZBX-27108] fixed issue where graph time selector caused full page refresh and lost current pagination (msnihach)
fix[ZBX-27058] fixed unsupported items in HPE iLO by HTTP (kflorowski)
fix[ZBX-25988] fixed problem with multiple columns being created on column create in widgets (wczerneha)
fix[ZBX-26931] fixed service list to display inaccessible service error when opening or refreshing list of deleted services (gberzina)
fix[ZBX-27584] improved configuration sync performance on Zabbix proxy by deleting in batches (vso)
fix[ZBX-27312] fixed issue of Zabbix agent 2 sometimes returning wrong result for proc.num (arimdjonoks)
fix[ZBX-26899] fixed yaml markings for import compare (gberzina)
fix[ZBX-26979] fixed issue causing empty error message when adding new template group to template (msnihach)
fix[ZBX-26542] fixed max period calculation method for graphs in parameter validation for allowed period (msnihach)
fix[ZBX-27306] added optional upgrade patch to ensure that web scenario item tags correspond to web scenario tags (arimdjonoks)
securityFixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…
securityFixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…
securityFixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…
fix[ZBX-27590] reverted the custom-on-fail discard value behavior so that it now correctly discards the value instead of resetting the error state and recalculating dependent items (vso)
fix[ZBX-26579] added possibility to switch SSO user on internal login failures (jfreibergs)
securityFixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
fix[ZBX-27387] fixed deadlock during auto registration and SQLite (vso)
securityFixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
securityFixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
fix[ZBX-27639] fixed regexp input validation to match whole input instead of per line match (askolmeisters)
fix[ZBX-27153] fixed undefined index error in SVG graphs for Zabbix agent active items (gcalenko)
fix[ZBX-27156] fix CPU spike in Zabbix agent 2 mysql plugin (esneiders)
feature[ZBXNEXT-10271] updated maximum supported TimescaleDB version to 2.22 (mprihodko)
feature[ZBXNEXT-10245] added Stormshield SNS by SNMP template (knaglis)
feature[ZBXNEXT-10219] updated maximum supported PostgreSQL version to 18 (mprihodko)
feature[ZBXNEXT-7744] added TLS support for Zabbix agent 2 Redis plugin (opucka)
fix[ZBX-27113] improved performance and memory usage by not storing item unsupported error in configuration cache (vso)
fix[ZBX-27111] fixed new timer being allocated each time trigger value is updated (vso)
fix[ZBX-26544] added preprocessing step to "Outbound packets discarded" item in FortiGate by SNMP template (aiantsen)
fix[ZBX-22157] added Map navigation tree widget problem filtering using "Problem display" and "Show suppressed problems" filters of map settings (dfofanovs)
fix[ZBX-27059] fixed conditions for "Cannot delete default MFA method" check (dpankins)
fix[ZBX-24504] improved Prometheus to JSON preprocessing step performance when reused with similar parameters in dependent items (wiper)
fix[ZBX-25743] fixed broken item selection list in Firefox (gklavins, wczerneha)
fix[ZBX-25148] added adjustments for sequential data entries with the same timestamp (askolmeisters)
fix[ZBX-25394] fixed unassigned proxy indication on Queue details page; extended coverage to proxies managed by proxy groups (dpankins)
fix[ZBX-25263] fixed Zabbix agent to attempt next refresh of active checks in 60 seconds in case of connection errors (arimdjonoks)
fix[ZBX-26910] fixed Zabbix server and Zabbix proxy compilation on macOS or with custom library paths (vso)
fix[ZBX-25741] eliminated difference in host group lists via "Select" button and via search typing (wczerneha)
fix[ZBX-26941] fixed duplicate entry error when new value arrive after Zabbix server finished syncing trends (vso)
fix[ZBX-26893] fixed delay when executing tasks through Zabbix proxy such as test item, check now, remote command (vso)
fix[ZBX-26459] fixed Host macros view to avoid displaying both macro types when switching quickly (gberzina)
fix[ZBX-26776] fixed ability to change widget in Pie chart widget data set (gberzina)
fix[ZBX-22625] fixed JavaScript in HPE Synergy by HTTP template (abrosimovs)
fix[ZBX-26069] implemented re-broadcast behavior for widgets on forced update (ashubin, wczerneha)
fix[ZBX-24918] fixed crashes of Zabbix agent 2 for Windows related to PDH perf_counter (opucka)
fix[ZBX-26755] fixed problem with Zabbix agent 2 MQTT plugin not establishing connection if first call failed (opucka)
fix[ZBX-16162] fixed classic graphs rendering when throttling is used (Sasha)
fix[ZBX-24046] fixed incorrect error message for ldap_jit_interval field in LDAP settings form (kkuzmina)
fix[ZBX-25038] fixed SCIM error message by adding mention of requested endpoint to it (kkuzmina)
fix[ZBX-26851] changed macro names in MSSQL templates (sbelakovs)