Zabbix 7.0.20 → 7.0.27
7 releases · 0 breaking changes · 9 security fixes · 9 advisories fixed
9security0breaking0deprecated9feature59fix
Vulnerabilities fixed by this upgrade
- 4.9 CVE-2026-23938 An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
- 5.4 CVE-2026-23929 Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…
- 7.5 CVE-2026-23930 An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…
- 6.8 CVE-2026-23928 The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…
- 6.5 CVE-2026-23927 A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…
- 6.8 CVE-2026-23926 An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…
- 8.8 CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
- 4.9 CVE-2026-23924 Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
- 8.8 CVE-2026-23920 Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent… in 7.0.27
- security Fixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service. in 7.0.27
- security Fixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu… in 7.0.25
- security Fixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac… in 7.0.24
- security Fixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato… in 7.0.24
- security Fixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat… in 7.0.24
- security Fixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary… in 7.0.23
- security Fixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth… in 7.0.22
- security Fixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected… in 7.0.22
Every release in between
securityFixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…
securityFixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
fix[ZBX-28075] fixed potential type mismatch in JS exception handling (MVekslers)
fix[ZBX-22504] improved memory usage in LLD worker processes with large low-level discovery (vso)
fix[ZBX-27780] restored support of LLD macros in LLD rule override operations Update interval, History, and Trends (dpankins)
fix[ZBX-27736] fixed no_data trigger flickering into unknown state for unsupported items (arimdjonoks)
fix[ZBX-27708] fixed error being displayed instead of graph for graphs with maximum height (kastafjevs)
fix[ZBX-27304] fixed missing gap between tag badges when widget overlay dialog is open (isharha)
fix[ZBX-25509] fixed z-select re-rendering after sorting (dpankins)
fix[ZBX-27210] fixed infinite loading on widgets after removing maps from Map Navigation Tree widget (aluchko)
fix[ZBX-27694] updated dependent item key from vm.memory.utilization to vm.memory.util in Linux by Zabbix agent active and passive templates (smansurovs)
fix[ZBX-27399] fixed possible deadlocks in configuration cache sync (sboidenko)
fix[ZBX-27675] improved configuration syncer not to reserve large amounts of memory (vso)
fix[ZBX-27475] fixed typo in Mattermost webhook "fallback" field name (smansurovs)
fix[ZBX-26742] fixed text overlap in pop-ups for Portuguese (gklavins)
fix[ZBX-27632] fixed trigger severity checkboxes update to checked state after validation error (kastafjevs)
fix[ZBX-27022] fixed preprocessing step "Discard unchanged" for string types (Andris, askolmeisters)
fix[ZBX-27688] removed checks to prevent bulk enabling of Gmail and Office 365 media types with incomplete configuration (aluchko)
fix[ZBX-27652] fixed incorrect documentation link for Administration/General/Other (aluchko)
fix[ZBX-27517] fixed "page not found" issue when exporting template that contains inaccessible dashboard element (aluchko)
fix[ZBX-27121] fixed issue where repeatedly clicking Close button on notifications floating pop-up caused error (msnihach)
feature[ZBXNEXT-9722] added authentication macros to Redis by Zabbix agent 2 template (smansurovs)
feature[ZBXNEXT-10502] added support for native connection mode in Ceph by Zabbix agent 2 template (abakaldin)
feature[ZBXNEXT-10211] added info about VMware entities to alarm JSON and ifbackingnetwork info to JSON for *vm.discovery and *vm.net.if.discovery items (MVekslers)
fix[ZBX-27496] improved network discovery subsystem to work with snmpv1 and snmpv2c checks (MVekslers)
fix[ZBX-27635] fixed Zabbix server and proxy build without libcurl (arimdjonoks)
fix[ZBX-27592] fixed memory items becoming unsupported in Apache templates (kflorowski)
fix[ZBX-17971] fixed macro view in trigger descriptions in some SNMP templates (abrosimovs)
fix[ZBX-27610] fixed http agent item user macros not resolving in required status codes (kastafjevs)
fix[ZBX-26388] improved memory usage monitoring for Docker by Zabbix agent 2 template (smansurovs)
fix[ZBX-27115] fixed some ODBC errors not being processed (mkorotkov)
fix[ZBX-27025] fixed incorrect header parsing in JS files (kflorowski)
fix[ZBX-27485] fixed issue with disabled toggling and readonly attributes in "Access to API" section (msnihach)
fix[ZBX-27418] fixed "disk failed" status in HPE Primera by HTTP template (smansurovs)
fix[ZBX-27611] reduced received data size for Elasticsearch template (kflorowski)
fix[ZBX-27552] fixed macro descriptions in Azure template (kflorowski)
fix[ZBX-27569] fixed broadcasting of item in Item history widget (dfofanovs)
securityFixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…
feature[ZBXNEXT-10121] added support for PHP 8.5 (talbergs)
feature[ZBXNEXT-10553] updated maximum supported TimescaleDB version to 2.26 (mprihodko)
feature[ZBXNEXT-10448] updated maximum supported MySQL version to 9.6 (mprihodko)
feature[ZBXNEXT-10422] added Cradlepoint NCM v2 by HTTP and Cradlepoint NCM v2 device by HTTP templates (aiantsen)
feature[ZBXNEXT-9961] added webhook for IBM Maximo service request creation (abrosimovs)
feature[ZBXNEXT-10477] updated maximum supported MariaDB version to 12.2 (mprihodko)
fix[ZBX-28068] fixed property name handling in JavaScript objects (averza)
fix[ZBX-27662] renamed GLPI media type (mruszczyk)
fix[ZBX-27542] fixed memory leak in Zabbix Agent 2 scheduler (mkorotkov)
fix[ZBX-27179] fixed incorrect man page for Zabbix agent 2 (dbriedis)
fix[ZBX-26341] fixed hint-box disappearing on refresh in problems (gklavins)
fix[ZBX-27044] fixed inconsistent focus and selection of primary fields in forms (averza)
fix[ZBX-27056] enabled displaying setting links in top drop-down menu for custom UI modules (aluchko)
fix[ZBX-27582] fixed history syncer being blocked when checking if new timers are added or updated (vso)
fix[ZBX-27147] added RESTful API v2 support with OAuth2 and updated endpoints in GLPi media type (mruszczyk)
fix[ZBX-27626] fixed crash during configuration sync after removing prototype trigger with non-prototype item (wiper)
fix[ZBX-26128] fixed sort order for problem and event acknowledgements to use ID for same timestamp records (gberzina, rgontarski)
fix[ZBX-27108] fixed issue where graph time selector caused full page refresh and lost current pagination (msnihach)
fix[ZBX-27058] fixed unsupported items in HPE iLO by HTTP (kflorowski)
fix[ZBX-25988] fixed problem with multiple columns being created on column create in widgets (wczerneha)
fix[ZBX-26931] fixed service list to display inaccessible service error when opening or refreshing list of deleted services (gberzina)
fix[ZBX-27584] improved configuration sync performance on Zabbix proxy by deleting in batches (vso)
fix[ZBX-27312] fixed issue of Zabbix agent 2 sometimes returning wrong result for proc.num (arimdjonoks)
fix[ZBX-26899] fixed yaml markings for import compare (gberzina)
fix[ZBX-26979] fixed issue causing empty error message when adding new template group to template (msnihach)
fix[ZBX-26542] fixed max period calculation method for graphs in parameter validation for allowed period (msnihach)
fix[ZBX-27306] added optional upgrade patch to ensure that web scenario item tags correspond to web scenario tags (arimdjonoks)
securityFixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…
securityFixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…
securityFixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…
fix[ZBX-27590] reverted the custom-on-fail discard value behavior so that it now correctly discards the value instead of resetting the error state and recalculating dependent items (vso)
fix[ZBX-26579] added possibility to switch SSO user on internal login failures (jfreibergs)
securityFixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
fix[ZBX-27387] fixed deadlock during auto registration and SQLite (vso)
securityFixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
securityFixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
fix[ZBX-27639] fixed regexp input validation to match whole input instead of per line match (askolmeisters)
fix[ZBX-27153] fixed undefined index error in SVG graphs for Zabbix agent active items (gcalenko)
fix[ZBX-27156] fix CPU spike in Zabbix agent 2 mysql plugin (esneiders)