Zabbix 7.0.4 → 7.0.18
14 releases · 0 breaking changes · 9 security fixes · 9 advisories fixed
9security0breaking0deprecated9feature58fix
Vulnerabilities fixed by this upgrade
- 8.1 CVE-2026-23925 An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
- 4.3 CVE-2025-49641 A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
- 4.9 CVE-2025-27231 The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
- 3.5 CVE-2025-27238 Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
- 3.5 CVE-2024-42325 Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.
- 5.4 CVE-2024-45699 The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropri…
- 6.5 CVE-2024-45700 Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an…
- 3.1 CVE-2024-36469 Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.
- 8.8 CVE-2024-36465 A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori… in 7.0.18
- security Fixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now… in 7.0.18
- security Fixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. in 7.0.18
- security Fixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h… in 7.0.17
- security Fixes CVE-2025-27238: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. in 7.0.14
- security Fixes CVE-2024-45700: Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an… in 7.0.10
- security Fixes CVE-2024-42325: Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. in 7.0.9
- security Fixes CVE-2024-36469: Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one. in 7.0.9
- security Fixes CVE-2024-45699: The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropri… in 7.0.7
Every release in between
securityFixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
securityFixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
securityFixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
fix[ZBX-26868] fixed crash when adding new SNMP device (vso)
securityFixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h…
feature[ZBXNEXT-10119] improved preprocessing diagnostics by highlighting top item IDs with the longest processing times (vso)
fix[ZBX-26693] fixed high memory usage by excluding values without preprocessing from being sent to the preprocessing manager (vso)
fix[ZBX-26661] fixed deadlock on autoreg_host table (vso)
fix[ZBX-26589] fixed DNS queries being performed for IP addresses when using older c-ares library (vso)
fix[ZBX-26610] fixed some tasks being stuck in preprocessing queue (wiper)
fix[ZBX-26588] fixed finished tasks queue size tracking which caused high cpu utilization by preprocessing manager (wiper)
securityFixes CVE-2025-27238: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
feature[ZBXNEXT-9931] added top items sorted by received values number and size to diaginfo preprocessing section (asestakovs)
feature[ZBXNEXT-9942] added preprocessor throughput to Zabbix server health templates (aiantsen)
feature[ZBXNEXT-9989] added supergroup topics support to Telegram media type, updated documentation (drasikhov)
fix[ZBX-26988] fixed non-super admin user restriction working incorrectly for hostprototype.get api method (aluchko)
fix[ZBX-26537] fixed memory over-allocation in preprocessing manager (vso)
fix[ZBX-26422] added missing translation string for "Tags" label in "Tags" tab in configuration forms (solonkins)
fix[ZBX-26294] improved logic of SNMP cache cleanup (dgoloscapov)
fix[ZBX-25929] improved digital clock widget element sizing (apoga)
fix[ZBX-21087] fixed not all aggregation functions working with foreach functions (aluchko)
fix[ZBX-26191] fixed inconsistent API and frontend validation for maintenance period 'every' and 'period' fields (aluchko)
fix[ZBX-23167] fixed issues with Host dashboards not displaying widgets from inaccessible templates; added hostdashboard object API (jfreibergs, vmaksimovs)
fix[ZBX-26123] added hostid parameter validation in web scenario configuration form (msnihach)
fix[ZBX-25420] fixed regsub/iregsub returning output if there is no match (talbergs)
fix[ZBX-26446] fixed Zabbix agent 2 S.M.A.R.T plugin failing on non-fatal exit status codes (esneiders)
fix[ZBX-26426] fixed preprocessing to flush values for an item in the same order they were sent to preprocessing (wiper)
fix[ZBX-26529] fixed memory leak when global variables are used in JavaScript preprocessing (vso)
fix[ZBX-26469] fixed Zabbix proxy crash in discovery manager process (Andris, MVekslers)
fix[ZBX-26187] fixed response to wmi.getall from Zabbix agent 2 not returning array-type values (mprihodko)
fix[ZBX-25944] replaced container name with container ID where used in queries and items for both Oracle templates and Oracle Zabbix agent 2 plugin (knaglis)
fix[ZBX-26131] disabled the menu item "Create trigger prototype" for item prototypes with binary data type (msnihach)
fix[ZBX-26478] fixed Zabbix server crash when shutting down DB and sending alert using script media type with no parameters (askolmeisters)
fix[ZBX-26116] fixed overload in history cache by vmware.eventlog item (MVekslers)
fix[ZBX-25968] added configuration validation of DBPort and DBSocket (rtrizna)
fix[ZBX-26344] refactored zbxcmd execute to avoid windows syscalls in Zabbix agent 2 (esneiders)
fix[ZBX-26433] fixed values outside of history storage period causing trigger to cache all values in storage period (vso)
fix[ZBX-25175] increased retry to 5 for asynchronous SNMP pollers to avoid failure if one of packets is lost (vso)
fix[ZBX-26092] fixed Office 365 relay media type domain formatting to replace all dash symbols with dot (msnihach)
fix[ZBX-26313] fixed SNMP preprocessing causing item to be unsupported when encountering wrong type (dgoloscapov)
fix[ZBX-26387] fixed newline being truncated in SNMP "get[" check (dgoloscapov)
fix[ZBX-26372] fixed long-running TimescaleDB queries when requesting historical data (gcalenko, Sasha)
fix[ZBX-26339] fixed user macro resolving order in templates so that in case of conflict import order of templates takes precedence over the linking order (askolmeisters)
fix[ZBX-18703] removed preprocessing step for mounted fs discovery in VMware Guest template (akotsegubov)
fix[ZBX-25713] fixed the map navigation tree widget selection issue (wczerneha)
fix[ZBX-26466] added ability for generic users to open the templates popup (Sasha)
fix[ZBX-26244] fixed Zabbix agent 2 memory leak related to traffic compression (MVekslers)
fix[ZBX-26114] improved Zabbix agent 2 accept rate on high RTT (sjurgensons)
fix[ZBX-25526] made Zabbix agent 2 proc.num, proc.cpu.util, proc.get and proc.mem items behave consistently with Zabbix agent when non-existing user is specified (arimdjonoks)
fix[ZBX-26369] added ticket type parameter to OTRS CE media type, updated documentation, added missing web service file (drasikhov)
fix[ZBX-26297] improved server warning log message for out of order value identifier detection between Zabbix server and Zabbix proxy (rtrizna)
+6 more items in the release notesfeature[ZBXNEXT-9909] added Azure Backup Jobs by HTTP template (abrosimovs)
feature[ZBXNEXT-9905] updated max supported TimescaleDB version to 2.19 (mprihodko)
feature[ZBXNEXT-9813] added vm/hv UUID filter for vmware.datastore.discovery item (MVekslers)
feature[ZBXNEXT-9927] implemented masking of secret user macros that are explicitly used (mprihodko)
feature[ZBXNEXT-9937] updated PostgreSQL templates to support versions 17 and above (drasikhov)
fix[ZBX-26259] fixed issue of event created from trigger prototypes missing tags inherited from templates (arimdjonoks)
fix[ZBX-26270] fixed database sync error after removing interface used by item (sboidenko)
fix[ZBX-26319] fixed timeout in remote script execution to use TrapperTimeout instead of 60 s (askolmeisters)
fix[ZBX-25402] fixed numbered user macro parsing in macro function (askolmeisters)
fix[ZBX-26050] updated dashboards in Zabbix server/proxy health templates (aiantsen)
fix[ZBX-26390] updated templated dashboard help icon link (Sasha)
fix[ZBX-25691] fixed the Problems by severity widget to display all existing problems (wczerneha)
fix[ZBX-25931] updated LLD filters in Systemd by Zabbix agent 2 template (drasikhov)
fix[ZBX-26292] fixed typo in script items for family of Nutanix templates (akotsegubov)
fix[ZBX-24341] fixed {HOST.CONN}, {HOST.DNS}, {HOST.IP}, and {HOST.PORT} macros to be properly resolved in HTTP agent item fields (asestakovs)
fix[ZBX-23996] fixed errors in Item value widget when change indicator was displayed without value (dfofanovs)
fix[ZBX-26198] filtered out items that do not affect interface availability status (dfofanovs)
fix[ZBX-26298] fixed expansions of all further user macros after undefined user macro (sboidenko)
fix[ZBX-26335] fixed trigger expression in Azure SQL Managed Instance by HTTP template (abrosimovs)
fix[ZBX-26235] fixed Zabbix server crash caused by audit when autoregistration deletes host tags (arimdjonoks)
otherZABBIX 7.0.12
otherZABBIX 7.0.11rc2
securityFixes CVE-2024-45700: Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an…
otherZABBIX 7.0.10
securityFixes CVE-2024-42325: Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.
securityFixes CVE-2024-36469: Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.
otherZABBIX 7.0.9
otherZABBIX 7.0.8rc2
securityFixes CVE-2024-45699: The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropri…
otherZABBIX 7.0.7rc1
otherZABBIX 7.0.6rc1
otherZABBIX 7.0.5