Zabbix 7.0.22 → 7.0.28
6 releases · 0 breaking changes · 10 security fixes · 10 advisories fixed
10security0breaking0deprecated14feature78fix
Vulnerabilities fixed by this upgrade
- 4.9 CVE-2026-23938 An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
- 5.4 CVE-2026-23929 Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…
- 7.5 CVE-2026-23930 An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…
- 4.9 CVE-2026-23935 A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
- 6.5 CVE-2026-23937 The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
- 3.7 CVE-2026-1199 Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…
- 6.8 CVE-2026-23928 The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…
- 6.5 CVE-2026-23927 A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…
- 6.8 CVE-2026-23926 An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…
- 4.9 CVE-2026-23924 Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. in 7.0.28
- security Fixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss. in 7.0.28
- security Fixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing… in 7.0.28
- security Fixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent… in 7.0.27
- security Fixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service. in 7.0.27
- security Fixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu… in 7.0.25
- security Fixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac… in 7.0.24
- security Fixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato… in 7.0.24
- security Fixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat… in 7.0.24
- security Fixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary… in 7.0.23
Every release in between
securityFixes CVE-2026-23937: The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
securityFixes CVE-2026-23935: A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
securityFixes CVE-2026-1199: Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing…
feature[ZBXNEXT-10478] updated maximum supported MariaDB version to 12.3 (mprihodko)
feature[ZBXNEXT-10211] updated alarm discovery in vmware template (abakaldin)
feature[ZBXNEXT-10611] added real host name for native vmware.*.alarms.get item keys (MVekslers)
feature[ZBXNEXT-10618] updated maximum supported TimescaleDB version to 2.27 (mprihodko)
feature[ZBXNEXT-10592] updated maximum supported MySQL version to 9.7 (mprihodko)
fix[ZBX-28076] improved login handling (vbodrihins)
fix[ZBX-28074] fixed potential disclosure of some write-only fields through API filter and search parameters (dpankins)
fix[ZBX-28073] improved behavior of script HttpRequest call (MVekslers)
fix[ZBX-27495] fixed excessive history upload delay for both Zabbix agents (vsmelovs)
fix[ZBX-27883] fixed inability to copy trigger prototypes that depend on same trigger prototype when cloning template or host (vmaksimovs)
fix[ZBX-27900] fixed Windows job handle not being closed on Zabbix agent 2 (esneiders)
fix[ZBX-27594] fixed sorting of discovered hosts (msnihach)
fix[ZBX-27770] fixed validation of HTTP response data for scenario-level dynamic variables in web monitoring (sboidenko)
fix[ZBX-27561] mitigated recurring system errors when editing groups for users or hosts in parallel API requests (kkuzmina, mprihodko)
fix[ZBX-26766] fixed code error when updating host, template, or user groups with duplicate group set entries (jfreibergs)
fix[ZBX-27382] fixed incorrect tag-based service permission check (averza)
fix[ZBX-27200] fixed invalid statuses for hosts and services during network discovery when host is found on several IP addresses (aetatsu)
fix[ZBX-27144] fixed legend text clipping at bottom of downloaded widget images (aluchko)
fix[ZBX-27732] fixed auto refresh to continue running in Latest data view (uolekss)
fix[ZBX-26048] fixed long error title visibility in frontend modal window (isharha)
fix[ZBX-25461] fixed contrast problems with severity icons in high-contrast themes (kastafjevs)
fix[ZBX-26788] fixed duplicate announcement of month and year in datepicker for assistive technologies (aluchko)
fix[ZBX-27777] fixed dashboard widget decimals for Azure SQL Managed Instance by HTTP template (kbruvers)
fix[ZBX-27698] fixed Clock widget "Server time" displaying same time as browser local time (aluchko)
fix[ZBX-24054] fixed template cloning with extended amount of mappings (gklavins)
fix[ZBX-27809] fixed QR code generation by using integer pixel alignment to eliminate module distortion (gberzina)
fix[ZBX-27510] fixed Geomap widget not resizing map on container resize (averza)
securityFixes CVE-2026-23930: An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potent…
securityFixes CVE-2026-23938: An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
fix[ZBX-28075] fixed potential type mismatch in JS exception handling (MVekslers)
fix[ZBX-22504] improved memory usage in LLD worker processes with large low-level discovery (vso)
fix[ZBX-27780] restored support of LLD macros in LLD rule override operations Update interval, History, and Trends (dpankins)
fix[ZBX-27736] fixed no_data trigger flickering into unknown state for unsupported items (arimdjonoks)
fix[ZBX-27708] fixed error being displayed instead of graph for graphs with maximum height (kastafjevs)
fix[ZBX-27304] fixed missing gap between tag badges when widget overlay dialog is open (isharha)
fix[ZBX-25509] fixed z-select re-rendering after sorting (dpankins)
fix[ZBX-27210] fixed infinite loading on widgets after removing maps from Map Navigation Tree widget (aluchko)
fix[ZBX-27694] updated dependent item key from vm.memory.utilization to vm.memory.util in Linux by Zabbix agent active and passive templates (smansurovs)
fix[ZBX-27399] fixed possible deadlocks in configuration cache sync (sboidenko)
fix[ZBX-27675] improved configuration syncer not to reserve large amounts of memory (vso)
fix[ZBX-27475] fixed typo in Mattermost webhook "fallback" field name (smansurovs)
fix[ZBX-26742] fixed text overlap in pop-ups for Portuguese (gklavins)
fix[ZBX-27632] fixed trigger severity checkboxes update to checked state after validation error (kastafjevs)
fix[ZBX-27022] fixed preprocessing step "Discard unchanged" for string types (Andris, askolmeisters)
fix[ZBX-27688] removed checks to prevent bulk enabling of Gmail and Office 365 media types with incomplete configuration (aluchko)
fix[ZBX-27652] fixed incorrect documentation link for Administration/General/Other (aluchko)
fix[ZBX-27517] fixed "page not found" issue when exporting template that contains inaccessible dashboard element (aluchko)
fix[ZBX-27121] fixed issue where repeatedly clicking Close button on notifications floating pop-up caused error (msnihach)
feature[ZBXNEXT-9722] added authentication macros to Redis by Zabbix agent 2 template (smansurovs)
feature[ZBXNEXT-10502] added support for native connection mode in Ceph by Zabbix agent 2 template (abakaldin)
feature[ZBXNEXT-10211] added info about VMware entities to alarm JSON and ifbackingnetwork info to JSON for *vm.discovery and *vm.net.if.discovery items (MVekslers)
fix[ZBX-27496] improved network discovery subsystem to work with snmpv1 and snmpv2c checks (MVekslers)
fix[ZBX-27635] fixed Zabbix server and proxy build without libcurl (arimdjonoks)
fix[ZBX-27592] fixed memory items becoming unsupported in Apache templates (kflorowski)
fix[ZBX-17971] fixed macro view in trigger descriptions in some SNMP templates (abrosimovs)
fix[ZBX-27610] fixed http agent item user macros not resolving in required status codes (kastafjevs)
fix[ZBX-26388] improved memory usage monitoring for Docker by Zabbix agent 2 template (smansurovs)
fix[ZBX-27115] fixed some ODBC errors not being processed (mkorotkov)
fix[ZBX-27025] fixed incorrect header parsing in JS files (kflorowski)
fix[ZBX-27485] fixed issue with disabled toggling and readonly attributes in "Access to API" section (msnihach)
fix[ZBX-27418] fixed "disk failed" status in HPE Primera by HTTP template (smansurovs)
fix[ZBX-27611] reduced received data size for Elasticsearch template (kflorowski)
fix[ZBX-27552] fixed macro descriptions in Azure template (kflorowski)
fix[ZBX-27569] fixed broadcasting of item in Item history widget (dfofanovs)
securityFixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…
feature[ZBXNEXT-10121] added support for PHP 8.5 (talbergs)
feature[ZBXNEXT-10553] updated maximum supported TimescaleDB version to 2.26 (mprihodko)
feature[ZBXNEXT-10448] updated maximum supported MySQL version to 9.6 (mprihodko)
feature[ZBXNEXT-10422] added Cradlepoint NCM v2 by HTTP and Cradlepoint NCM v2 device by HTTP templates (aiantsen)
feature[ZBXNEXT-9961] added webhook for IBM Maximo service request creation (abrosimovs)
feature[ZBXNEXT-10477] updated maximum supported MariaDB version to 12.2 (mprihodko)
fix[ZBX-28068] fixed property name handling in JavaScript objects (averza)
fix[ZBX-27662] renamed GLPI media type (mruszczyk)
fix[ZBX-27542] fixed memory leak in Zabbix Agent 2 scheduler (mkorotkov)
fix[ZBX-27179] fixed incorrect man page for Zabbix agent 2 (dbriedis)
fix[ZBX-26341] fixed hint-box disappearing on refresh in problems (gklavins)
fix[ZBX-27044] fixed inconsistent focus and selection of primary fields in forms (averza)
fix[ZBX-27056] enabled displaying setting links in top drop-down menu for custom UI modules (aluchko)
fix[ZBX-27582] fixed history syncer being blocked when checking if new timers are added or updated (vso)
fix[ZBX-27147] added RESTful API v2 support with OAuth2 and updated endpoints in GLPi media type (mruszczyk)
fix[ZBX-27626] fixed crash during configuration sync after removing prototype trigger with non-prototype item (wiper)
fix[ZBX-26128] fixed sort order for problem and event acknowledgements to use ID for same timestamp records (gberzina, rgontarski)
fix[ZBX-27108] fixed issue where graph time selector caused full page refresh and lost current pagination (msnihach)
fix[ZBX-27058] fixed unsupported items in HPE iLO by HTTP (kflorowski)
fix[ZBX-25988] fixed problem with multiple columns being created on column create in widgets (wczerneha)
fix[ZBX-26931] fixed service list to display inaccessible service error when opening or refreshing list of deleted services (gberzina)
fix[ZBX-27584] improved configuration sync performance on Zabbix proxy by deleting in batches (vso)
fix[ZBX-27312] fixed issue of Zabbix agent 2 sometimes returning wrong result for proc.num (arimdjonoks)
fix[ZBX-26899] fixed yaml markings for import compare (gberzina)
fix[ZBX-26979] fixed issue causing empty error message when adding new template group to template (msnihach)
fix[ZBX-26542] fixed max period calculation method for graphs in parameter validation for allowed period (msnihach)
fix[ZBX-27306] added optional upgrade patch to ensure that web scenario item tags correspond to web scenario tags (arimdjonoks)
securityFixes CVE-2026-23928: The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized ac…
securityFixes CVE-2026-23926: An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigato…
securityFixes CVE-2026-23927: A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle dat…
fix[ZBX-27590] reverted the custom-on-fail discard value behavior so that it now correctly discards the value instead of resetting the error state and recalculating dependent items (vso)
fix[ZBX-26579] added possibility to switch SSO user on internal login failures (jfreibergs)
securityFixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
fix[ZBX-27387] fixed deadlock during auto registration and SQLite (vso)