Zabbix 7.0.2 → 7.0.18
16 releases · 0 breaking changes · 20 security fixes · 20 advisories fixed
20security0breaking0deprecated9feature58fix
Vulnerabilities fixed by this upgrade
- 8.1 CVE-2026-23925 An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
- 4.3 CVE-2025-49641 A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
- 4.9 CVE-2025-27231 The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
- 3.5 CVE-2025-27238 Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
- 7.2 CVE-2025-27240 A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.
- 3.5 CVE-2024-42325 Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.
- 5.4 CVE-2024-45699 The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropri…
- 6.5 CVE-2024-45700 Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an…
- 3.1 CVE-2024-36469 Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.
- 8.8 CVE-2024-36465 A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.
- 9.1 CVE-2024-42330 The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by t…
- 3.3 CVE-2024-42331 In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error…
- 3.7 CVE-2024-42332 The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This a…
- 2.7 CVE-2024-42333 The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c
- 3.0 CVE-2024-36468 The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityE…
- 4.4 CVE-2024-42326 There was discovered a use after free bug in browser.c in the es_browser_get_variant function
- 3.3 CVE-2024-42328 When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is…
- 3.3 CVE-2024-42329 The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error descr…
- 2.2 CVE-2024-22117 When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. H…
- 6.5 CVE-2024-36463 The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects.
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori… in 7.0.18
- security Fixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now… in 7.0.18
- security Fixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. in 7.0.18
- security Fixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h… in 7.0.17
- security Fixes CVE-2025-27238: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. in 7.0.14
- security Fixes CVE-2024-45700: Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an… in 7.0.10
- security Fixes CVE-2024-42325: Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. in 7.0.9
- security Fixes CVE-2024-36469: Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one. in 7.0.9
- security Fixes CVE-2024-45699: The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropri… in 7.0.7
- security Fixes CVE-2024-42330: The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by t… in 7.0.4
- security Fixes CVE-2025-27240: A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field. in 7.0.4
- security Fixes CVE-2024-42331: In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error… in 7.0.4
- security Fixes CVE-2024-42328: When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is… in 7.0.4
- security Fixes CVE-2024-42329: The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error descr… in 7.0.4
- security Fixes CVE-2024-42333: The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c in 7.0.4
- security Fixes CVE-2024-22117: When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. H… in 7.0.4
- security Fixes CVE-2024-36463: The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. in 7.0.3
- security Fixes CVE-2024-42326: There was discovered a use after free bug in browser.c in the es_browser_get_variant function in 7.0.3
- security Fixes CVE-2024-42332: The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This a… in 7.0.3
- security Fixes CVE-2024-36468: The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityE… in 7.0.3
Every release in between
securityFixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
securityFixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
securityFixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
fix[ZBX-26868] fixed crash when adding new SNMP device (vso)
securityFixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h…
feature[ZBXNEXT-10119] improved preprocessing diagnostics by highlighting top item IDs with the longest processing times (vso)
fix[ZBX-26693] fixed high memory usage by excluding values without preprocessing from being sent to the preprocessing manager (vso)
fix[ZBX-26661] fixed deadlock on autoreg_host table (vso)
fix[ZBX-26589] fixed DNS queries being performed for IP addresses when using older c-ares library (vso)
fix[ZBX-26610] fixed some tasks being stuck in preprocessing queue (wiper)
fix[ZBX-26588] fixed finished tasks queue size tracking which caused high cpu utilization by preprocessing manager (wiper)
securityFixes CVE-2025-27238: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
feature[ZBXNEXT-9931] added top items sorted by received values number and size to diaginfo preprocessing section (asestakovs)
feature[ZBXNEXT-9942] added preprocessor throughput to Zabbix server health templates (aiantsen)
feature[ZBXNEXT-9989] added supergroup topics support to Telegram media type, updated documentation (drasikhov)
fix[ZBX-26988] fixed non-super admin user restriction working incorrectly for hostprototype.get api method (aluchko)
fix[ZBX-26537] fixed memory over-allocation in preprocessing manager (vso)
fix[ZBX-26422] added missing translation string for "Tags" label in "Tags" tab in configuration forms (solonkins)
fix[ZBX-26294] improved logic of SNMP cache cleanup (dgoloscapov)
fix[ZBX-25929] improved digital clock widget element sizing (apoga)
fix[ZBX-21087] fixed not all aggregation functions working with foreach functions (aluchko)
fix[ZBX-26191] fixed inconsistent API and frontend validation for maintenance period 'every' and 'period' fields (aluchko)
fix[ZBX-23167] fixed issues with Host dashboards not displaying widgets from inaccessible templates; added hostdashboard object API (jfreibergs, vmaksimovs)
fix[ZBX-26123] added hostid parameter validation in web scenario configuration form (msnihach)
fix[ZBX-25420] fixed regsub/iregsub returning output if there is no match (talbergs)
fix[ZBX-26446] fixed Zabbix agent 2 S.M.A.R.T plugin failing on non-fatal exit status codes (esneiders)
fix[ZBX-26426] fixed preprocessing to flush values for an item in the same order they were sent to preprocessing (wiper)
fix[ZBX-26529] fixed memory leak when global variables are used in JavaScript preprocessing (vso)
fix[ZBX-26469] fixed Zabbix proxy crash in discovery manager process (Andris, MVekslers)
fix[ZBX-26187] fixed response to wmi.getall from Zabbix agent 2 not returning array-type values (mprihodko)
fix[ZBX-25944] replaced container name with container ID where used in queries and items for both Oracle templates and Oracle Zabbix agent 2 plugin (knaglis)
fix[ZBX-26131] disabled the menu item "Create trigger prototype" for item prototypes with binary data type (msnihach)
fix[ZBX-26478] fixed Zabbix server crash when shutting down DB and sending alert using script media type with no parameters (askolmeisters)
fix[ZBX-26116] fixed overload in history cache by vmware.eventlog item (MVekslers)
fix[ZBX-25968] added configuration validation of DBPort and DBSocket (rtrizna)
fix[ZBX-26344] refactored zbxcmd execute to avoid windows syscalls in Zabbix agent 2 (esneiders)
fix[ZBX-26433] fixed values outside of history storage period causing trigger to cache all values in storage period (vso)
fix[ZBX-25175] increased retry to 5 for asynchronous SNMP pollers to avoid failure if one of packets is lost (vso)
fix[ZBX-26092] fixed Office 365 relay media type domain formatting to replace all dash symbols with dot (msnihach)
fix[ZBX-26313] fixed SNMP preprocessing causing item to be unsupported when encountering wrong type (dgoloscapov)
fix[ZBX-26387] fixed newline being truncated in SNMP "get[" check (dgoloscapov)
fix[ZBX-26372] fixed long-running TimescaleDB queries when requesting historical data (gcalenko, Sasha)
fix[ZBX-26339] fixed user macro resolving order in templates so that in case of conflict import order of templates takes precedence over the linking order (askolmeisters)
fix[ZBX-18703] removed preprocessing step for mounted fs discovery in VMware Guest template (akotsegubov)
fix[ZBX-25713] fixed the map navigation tree widget selection issue (wczerneha)
fix[ZBX-26466] added ability for generic users to open the templates popup (Sasha)
fix[ZBX-26244] fixed Zabbix agent 2 memory leak related to traffic compression (MVekslers)
fix[ZBX-26114] improved Zabbix agent 2 accept rate on high RTT (sjurgensons)
fix[ZBX-25526] made Zabbix agent 2 proc.num, proc.cpu.util, proc.get and proc.mem items behave consistently with Zabbix agent when non-existing user is specified (arimdjonoks)
fix[ZBX-26369] added ticket type parameter to OTRS CE media type, updated documentation, added missing web service file (drasikhov)
fix[ZBX-26297] improved server warning log message for out of order value identifier detection between Zabbix server and Zabbix proxy (rtrizna)
+6 more items in the release notesfeature[ZBXNEXT-9909] added Azure Backup Jobs by HTTP template (abrosimovs)
feature[ZBXNEXT-9905] updated max supported TimescaleDB version to 2.19 (mprihodko)
feature[ZBXNEXT-9813] added vm/hv UUID filter for vmware.datastore.discovery item (MVekslers)
feature[ZBXNEXT-9927] implemented masking of secret user macros that are explicitly used (mprihodko)
feature[ZBXNEXT-9937] updated PostgreSQL templates to support versions 17 and above (drasikhov)
fix[ZBX-26259] fixed issue of event created from trigger prototypes missing tags inherited from templates (arimdjonoks)
fix[ZBX-26270] fixed database sync error after removing interface used by item (sboidenko)
fix[ZBX-26319] fixed timeout in remote script execution to use TrapperTimeout instead of 60 s (askolmeisters)
fix[ZBX-25402] fixed numbered user macro parsing in macro function (askolmeisters)
fix[ZBX-26050] updated dashboards in Zabbix server/proxy health templates (aiantsen)
fix[ZBX-26390] updated templated dashboard help icon link (Sasha)
fix[ZBX-25691] fixed the Problems by severity widget to display all existing problems (wczerneha)
fix[ZBX-25931] updated LLD filters in Systemd by Zabbix agent 2 template (drasikhov)
fix[ZBX-26292] fixed typo in script items for family of Nutanix templates (akotsegubov)
fix[ZBX-24341] fixed {HOST.CONN}, {HOST.DNS}, {HOST.IP}, and {HOST.PORT} macros to be properly resolved in HTTP agent item fields (asestakovs)
fix[ZBX-23996] fixed errors in Item value widget when change indicator was displayed without value (dfofanovs)
fix[ZBX-26198] filtered out items that do not affect interface availability status (dfofanovs)
fix[ZBX-26298] fixed expansions of all further user macros after undefined user macro (sboidenko)
fix[ZBX-26335] fixed trigger expression in Azure SQL Managed Instance by HTTP template (abrosimovs)
fix[ZBX-26235] fixed Zabbix server crash caused by audit when autoregistration deletes host tags (arimdjonoks)
otherZABBIX 7.0.12
otherZABBIX 7.0.11rc2
securityFixes CVE-2024-45700: Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an…
otherZABBIX 7.0.10
securityFixes CVE-2024-42325: Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.
securityFixes CVE-2024-36469: Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.
otherZABBIX 7.0.9
otherZABBIX 7.0.8rc2
securityFixes CVE-2024-45699: The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropri…
otherZABBIX 7.0.7rc1
otherZABBIX 7.0.6rc1
otherZABBIX 7.0.5
securityFixes CVE-2024-42330: The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by t…
securityFixes CVE-2025-27240: A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.
securityFixes CVE-2024-42331: In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error…
securityFixes CVE-2024-42328: When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is…
securityFixes CVE-2024-42329: The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error descr…
securityFixes CVE-2024-42333: The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c
securityFixes CVE-2024-22117: When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. H…
otherZABBIX 7.0.4
securityFixes CVE-2024-36463: The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects.
securityFixes CVE-2024-42326: There was discovered a use after free bug in browser.c in the es_browser_get_variant function
securityFixes CVE-2024-42332: The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This a…
securityFixes CVE-2024-36468: The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityE…
otherZABBIX 7.0.3