Zabbix 7.0.24 → 7.0.26

2 releases · 0 breaking changes · 1 security fix · 1 advisory fixed

1security0breaking0deprecated9feature34fix

Is 7.0.24 affected? · What changed up to 8.0.0

Vulnerabilities fixed by this upgrade

5.4 CVE-2026-23929 Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu… in 7.0.25

Every release in between

7.0.26 May 5, 2026 Release notes ↗

feature[ZBXNEXT-9722] added authentication macros to Redis by Zabbix agent 2 template (smansurovs)

feature[ZBXNEXT-10502] added support for native connection mode in Ceph by Zabbix agent 2 template (abakaldin)

feature[ZBXNEXT-10211] added info about VMware entities to alarm JSON and ifbackingnetwork info to JSON for *vm.discovery and *vm.net.if.discovery items (MVekslers)

fix[ZBX-27496] improved network discovery subsystem to work with snmpv1 and snmpv2c checks (MVekslers)

fix[ZBX-27635] fixed Zabbix server and proxy build without libcurl (arimdjonoks)

fix[ZBX-27592] fixed memory items becoming unsupported in Apache templates (kflorowski)

fix[ZBX-17971] fixed macro view in trigger descriptions in some SNMP templates (abrosimovs)

fix[ZBX-27610] fixed http agent item user macros not resolving in required status codes (kastafjevs)

fix[ZBX-26388] improved memory usage monitoring for Docker by Zabbix agent 2 template (smansurovs)

fix[ZBX-27115] fixed some ODBC errors not being processed (mkorotkov)

fix[ZBX-27025] fixed incorrect header parsing in JS files (kflorowski)

fix[ZBX-27485] fixed issue with disabled toggling and readonly attributes in "Access to API" section (msnihach)

fix[ZBX-27418] fixed "disk failed" status in HPE Primera by HTTP template (smansurovs)

fix[ZBX-27611] reduced received data size for Elasticsearch template (kflorowski)

fix[ZBX-27552] fixed macro descriptions in Azure template (kflorowski)

fix[ZBX-27569] fixed broadcasting of item in Item history widget (dfofanovs)

7.0.25 Apr 7, 2026 Release notes ↗

securityFixes CVE-2026-23929: Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQu…

feature[ZBXNEXT-10121] added support for PHP 8.5 (talbergs)

feature[ZBXNEXT-10553] updated maximum supported TimescaleDB version to 2.26 (mprihodko)

feature[ZBXNEXT-10448] updated maximum supported MySQL version to 9.6 (mprihodko)

feature[ZBXNEXT-10422] added Cradlepoint NCM v2 by HTTP and Cradlepoint NCM v2 device by HTTP templates (aiantsen)

feature[ZBXNEXT-9961] added webhook for IBM Maximo service request creation (abrosimovs)

feature[ZBXNEXT-10477] updated maximum supported MariaDB version to 12.2 (mprihodko)

fix[ZBX-28068] fixed property name handling in JavaScript objects (averza)

fix[ZBX-27662] renamed GLPI media type (mruszczyk)

fix[ZBX-27542] fixed memory leak in Zabbix Agent 2 scheduler (mkorotkov)

fix[ZBX-27179] fixed incorrect man page for Zabbix agent 2 (dbriedis)

fix[ZBX-26341] fixed hint-box disappearing on refresh in problems (gklavins)

fix[ZBX-27044] fixed inconsistent focus and selection of primary fields in forms (averza)

fix[ZBX-27056] enabled displaying setting links in top drop-down menu for custom UI modules (aluchko)

fix[ZBX-27582] fixed history syncer being blocked when checking if new timers are added or updated (vso)

fix[ZBX-27147] added RESTful API v2 support with OAuth2 and updated endpoints in GLPi media type (mruszczyk)

fix[ZBX-27626] fixed crash during configuration sync after removing prototype trigger with non-prototype item (wiper)

fix[ZBX-26128] fixed sort order for problem and event acknowledgements to use ID for same timestamp records (gberzina, rgontarski)

fix[ZBX-27108] fixed issue where graph time selector caused full page refresh and lost current pagination (msnihach)

fix[ZBX-27058] fixed unsupported items in HPE iLO by HTTP (kflorowski)

fix[ZBX-25988] fixed problem with multiple columns being created on column create in widgets (wczerneha)

fix[ZBX-26931] fixed service list to display inaccessible service error when opening or refreshing list of deleted services (gberzina)

fix[ZBX-27584] improved configuration sync performance on Zabbix proxy by deleting in batches (vso)

fix[ZBX-27312] fixed issue of Zabbix agent 2 sometimes returning wrong result for proc.num (arimdjonoks)

fix[ZBX-26899] fixed yaml markings for import compare (gberzina)

fix[ZBX-26979] fixed issue causing empty error message when adding new template group to template (msnihach)

fix[ZBX-26542] fixed max period calculation method for graphs in parameter validation for allowed period (msnihach)

fix[ZBX-27306] added optional upgrade patch to ensure that web scenario item tags correspond to web scenario tags (arimdjonoks)