Zabbix 7.0.8 → 7.0.23
15 releases · 0 breaking changes · 12 security fixes · 12 advisories fixed
12security0breaking0deprecated25feature114fix
Vulnerabilities fixed by this upgrade
- 8.8 CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
- 4.9 CVE-2026-23924 Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
- 6.0 CVE-2026-23919 For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no…
- 8.8 CVE-2026-23920 Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
- 8.1 CVE-2026-23925 An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
- 4.3 CVE-2025-49641 A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
- 4.9 CVE-2025-27231 The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
- 3.5 CVE-2025-27238 Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
- 3.5 CVE-2024-42325 Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.
- 6.5 CVE-2024-45700 Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an…
- 3.1 CVE-2024-36469 Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.
- 8.8 CVE-2024-36465 A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary… in 7.0.23
- security Fixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth… in 7.0.22
- security Fixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected… in 7.0.22
- security Fixes CVE-2026-23919: For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no… in 7.0.19
- security Fixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori… in 7.0.18
- security Fixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now… in 7.0.18
- security Fixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. in 7.0.18
- security Fixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h… in 7.0.17
- security Fixes CVE-2025-27238: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. in 7.0.14
- security Fixes CVE-2024-45700: Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an… in 7.0.10
- security Fixes CVE-2024-42325: Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. in 7.0.9
- security Fixes CVE-2024-36469: Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one. in 7.0.9
Every release in between
securityFixes CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary…
fix[ZBX-27387] fixed deadlock during auto registration and SQLite (vso)
securityFixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
securityFixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
fix[ZBX-27639] fixed regexp input validation to match whole input instead of per line match (askolmeisters)
fix[ZBX-27153] fixed undefined index error in SVG graphs for Zabbix agent active items (gcalenko)
fix[ZBX-27156] fix CPU spike in Zabbix agent 2 mysql plugin (esneiders)
feature[ZBXNEXT-10271] updated maximum supported TimescaleDB version to 2.22 (mprihodko)
feature[ZBXNEXT-10245] added Stormshield SNS by SNMP template (knaglis)
feature[ZBXNEXT-10219] updated maximum supported PostgreSQL version to 18 (mprihodko)
feature[ZBXNEXT-7744] added TLS support for Zabbix agent 2 Redis plugin (opucka)
fix[ZBX-27113] improved performance and memory usage by not storing item unsupported error in configuration cache (vso)
fix[ZBX-27111] fixed new timer being allocated each time trigger value is updated (vso)
fix[ZBX-26544] added preprocessing step to "Outbound packets discarded" item in FortiGate by SNMP template (aiantsen)
fix[ZBX-22157] added Map navigation tree widget problem filtering using "Problem display" and "Show suppressed problems" filters of map settings (dfofanovs)
fix[ZBX-27059] fixed conditions for "Cannot delete default MFA method" check (dpankins)
fix[ZBX-24504] improved Prometheus to JSON preprocessing step performance when reused with similar parameters in dependent items (wiper)
fix[ZBX-25743] fixed broken item selection list in Firefox (gklavins, wczerneha)
fix[ZBX-25148] added adjustments for sequential data entries with the same timestamp (askolmeisters)
fix[ZBX-25394] fixed unassigned proxy indication on Queue details page; extended coverage to proxies managed by proxy groups (dpankins)
fix[ZBX-25263] fixed Zabbix agent to attempt next refresh of active checks in 60 seconds in case of connection errors (arimdjonoks)
fix[ZBX-26910] fixed Zabbix server and Zabbix proxy compilation on macOS or with custom library paths (vso)
fix[ZBX-25741] eliminated difference in host group lists via "Select" button and via search typing (wczerneha)
fix[ZBX-26941] fixed duplicate entry error when new value arrive after Zabbix server finished syncing trends (vso)
fix[ZBX-26893] fixed delay when executing tasks through Zabbix proxy such as test item, check now, remote command (vso)
fix[ZBX-26459] fixed Host macros view to avoid displaying both macro types when switching quickly (gberzina)
fix[ZBX-26776] fixed ability to change widget in Pie chart widget data set (gberzina)
fix[ZBX-22625] fixed JavaScript in HPE Synergy by HTTP template (abrosimovs)
fix[ZBX-26069] implemented re-broadcast behavior for widgets on forced update (ashubin, wczerneha)
fix[ZBX-24918] fixed crashes of Zabbix agent 2 for Windows related to PDH perf_counter (opucka)
fix[ZBX-26755] fixed problem with Zabbix agent 2 MQTT plugin not establishing connection if first call failed (opucka)
fix[ZBX-16162] fixed classic graphs rendering when throttling is used (Sasha)
fix[ZBX-24046] fixed incorrect error message for ldap_jit_interval field in LDAP settings form (kkuzmina)
fix[ZBX-25038] fixed SCIM error message by adding mention of requested endpoint to it (kkuzmina)
fix[ZBX-26851] changed macro names in MSSQL templates (sbelakovs)
securityFixes CVE-2026-23919: For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no…
feature[ZBXNEXT-10143] added "Highlight whole row" feature in non-compact mode in Problems (ashubin)
feature[ZBXNEXT-10106] extended preprocessor throughput monitoring in Zabbix server/proxy health templates (aiantsen)
feature[ZBXNEXT-9819] added new template Vyatta Virtual Router by SNMP (knaglis)
feature[ZBXNEXT-9933] added TNS name support for Zabbix agent 2 Oracle plugin (lsurvilo)
feature[ZBXNEXT-10107] improved device coverage in Huawei OceanStor Dorado by SNMP template (abrosimovs)
feature[ZBXNEXT-10123] added Aruba CX 8300s by SNMP template (akotsegubov)
feature[ZBXNEXT-10152] added new macro for disk discovery type selection in both SMART by Zabbix agent 2 templates (knaglis)
feature[ZBXNEXT-10027] prepared for removal of TimescaleDB API call deprecated since TimescaleDB 2.18.0 (jfreibergs)
feature[ZBXNEXT-10017] added Ciena 3906 by SNMP template (akotsegubov)
feature[ZBXNEXT-9255] updated Meraki templates to handle rate limit on API requests (aiantsen)
feature[ZBXNEXT-9902] changed timeout range for Zabbix JS and Zabbix get utilities (askolmeisters)
feature[ZBXNEXT-10077] updated maximum supported MariaDB version to 12.0 (mprihodko)
fix[ZBX-26419] improved performance of problem and event views by optimizing SQL queries to join only necessary triggers, eliminating redundant post-join filtering (vso)
fix[ZBX-25796] fixed confusing error message on item test timeout (isharha)
fix[ZBX-26337] removed unnecessary div elements for entries without problems in Item and Host navigator widgets (msnihach)
fix[ZBX-26873] fixed support for SSH item proxy through configurations in SSH configuration file (aetatsu)
fix[ZBX-19267] fixed wmi.get items sometimes incorrectly returning "Empty WMI search result" with Zabbix agent 2 (aetatsu)
fix[ZBX-20207] fixed unexpected interface connection mode change during autoregistration (vso)
fix[ZBX-25448] fixed token-based authentication method in FortiGate by HTTP template (egordymov)
fix[ZBX-26847] explicitly defined Oracle connection timezone in Zabbix agent 2 (opucka)
fix[ZBX-26472] fixed clearing of elements when imported file contains no background image or icon map (rgontarski)
fix[ZBX-26694] fixed media type test parameter maxlength (gberzina)
fix[ZBX-26416] fixed SNMP trap item processing issue after monitored host changes (sboidenko)
fix[ZBX-26801] fixed ability to select discovered items when editing graph items (gberzina)
fix[ZBX-20964] removed Problems link in Monitoring hosts page for user who does not have access (msnihach)
fix[ZBX-26621] added TLS host parameter update in autoregistration mode (vsmelovs)
fix[ZBX-26440] fixed inability to update JMX endpoint field in item, item prototype, and LLD forms (kkuzmina)
fix[ZBX-25041] improved configuration form validation in Graph and Pie chart widgets when referenced item widget is unavailable (isharha)
fix[ZBX-24720] fixed LDAP media type mapping "When active" field trimming (dpankins)
fix[ZBX-26892] fixed VMware Event Collector hangs in case of network errors (MVekslers)
fix[ZBX-26920] fixed wrong time in Zabbix agent for Windows (sboidenko)
fix[ZBX-25669] added trigger version check after upgrading to newer version (aluchko)
fix[ZBX-22786] fixed trends graph line color issue with PHP 8.1 (isharha)
fix[ZBX-26044] fixed Honeycomb widget not to display disabled items (rgontarski)
fix[ZBX-25540] fixed inconsistent link styling for dependent trigger prototypes (rgontarski)
fix[ZBX-26482] fixed TypeError after deleting datasets in Graph and Pie chart widgets (isharha)
fix[ZBX-26202] fixed inability to create "Execute now" tasks for users of Admin user type (jfreibergs)
fix[ZBX-24603] fixed MFA TOTP secrets not being deleted when deleting users from MFA-enabled user groups (agriscenko, jfreibergs)
fix[ZBX-25739] fixed timeleft() function to return 1.7976931348623157E+308 instead of making item unsupported in case of infinite time (arimdjonoks, averza)
+11 more items in the release notessecurityFixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
securityFixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
securityFixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
fix[ZBX-26868] fixed crash when adding new SNMP device (vso)
securityFixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h…
feature[ZBXNEXT-10119] improved preprocessing diagnostics by highlighting top item IDs with the longest processing times (vso)
fix[ZBX-26693] fixed high memory usage by excluding values without preprocessing from being sent to the preprocessing manager (vso)
fix[ZBX-26661] fixed deadlock on autoreg_host table (vso)
fix[ZBX-26589] fixed DNS queries being performed for IP addresses when using older c-ares library (vso)
fix[ZBX-26610] fixed some tasks being stuck in preprocessing queue (wiper)
fix[ZBX-26588] fixed finished tasks queue size tracking which caused high cpu utilization by preprocessing manager (wiper)
securityFixes CVE-2025-27238: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
feature[ZBXNEXT-9931] added top items sorted by received values number and size to diaginfo preprocessing section (asestakovs)
feature[ZBXNEXT-9942] added preprocessor throughput to Zabbix server health templates (aiantsen)
feature[ZBXNEXT-9989] added supergroup topics support to Telegram media type, updated documentation (drasikhov)
fix[ZBX-26988] fixed non-super admin user restriction working incorrectly for hostprototype.get api method (aluchko)
fix[ZBX-26537] fixed memory over-allocation in preprocessing manager (vso)
fix[ZBX-26422] added missing translation string for "Tags" label in "Tags" tab in configuration forms (solonkins)
fix[ZBX-26294] improved logic of SNMP cache cleanup (dgoloscapov)
fix[ZBX-25929] improved digital clock widget element sizing (apoga)
fix[ZBX-21087] fixed not all aggregation functions working with foreach functions (aluchko)
fix[ZBX-26191] fixed inconsistent API and frontend validation for maintenance period 'every' and 'period' fields (aluchko)
fix[ZBX-23167] fixed issues with Host dashboards not displaying widgets from inaccessible templates; added hostdashboard object API (jfreibergs, vmaksimovs)
fix[ZBX-26123] added hostid parameter validation in web scenario configuration form (msnihach)
fix[ZBX-25420] fixed regsub/iregsub returning output if there is no match (talbergs)
fix[ZBX-26446] fixed Zabbix agent 2 S.M.A.R.T plugin failing on non-fatal exit status codes (esneiders)
fix[ZBX-26426] fixed preprocessing to flush values for an item in the same order they were sent to preprocessing (wiper)
fix[ZBX-26529] fixed memory leak when global variables are used in JavaScript preprocessing (vso)
fix[ZBX-26469] fixed Zabbix proxy crash in discovery manager process (Andris, MVekslers)
fix[ZBX-26187] fixed response to wmi.getall from Zabbix agent 2 not returning array-type values (mprihodko)
fix[ZBX-25944] replaced container name with container ID where used in queries and items for both Oracle templates and Oracle Zabbix agent 2 plugin (knaglis)
fix[ZBX-26131] disabled the menu item "Create trigger prototype" for item prototypes with binary data type (msnihach)
fix[ZBX-26478] fixed Zabbix server crash when shutting down DB and sending alert using script media type with no parameters (askolmeisters)
fix[ZBX-26116] fixed overload in history cache by vmware.eventlog item (MVekslers)
fix[ZBX-25968] added configuration validation of DBPort and DBSocket (rtrizna)
fix[ZBX-26344] refactored zbxcmd execute to avoid windows syscalls in Zabbix agent 2 (esneiders)
fix[ZBX-26433] fixed values outside of history storage period causing trigger to cache all values in storage period (vso)
fix[ZBX-25175] increased retry to 5 for asynchronous SNMP pollers to avoid failure if one of packets is lost (vso)
fix[ZBX-26092] fixed Office 365 relay media type domain formatting to replace all dash symbols with dot (msnihach)
fix[ZBX-26313] fixed SNMP preprocessing causing item to be unsupported when encountering wrong type (dgoloscapov)
fix[ZBX-26387] fixed newline being truncated in SNMP "get[" check (dgoloscapov)
fix[ZBX-26372] fixed long-running TimescaleDB queries when requesting historical data (gcalenko, Sasha)
fix[ZBX-26339] fixed user macro resolving order in templates so that in case of conflict import order of templates takes precedence over the linking order (askolmeisters)
fix[ZBX-18703] removed preprocessing step for mounted fs discovery in VMware Guest template (akotsegubov)
fix[ZBX-25713] fixed the map navigation tree widget selection issue (wczerneha)
fix[ZBX-26466] added ability for generic users to open the templates popup (Sasha)
fix[ZBX-26244] fixed Zabbix agent 2 memory leak related to traffic compression (MVekslers)
fix[ZBX-26114] improved Zabbix agent 2 accept rate on high RTT (sjurgensons)
fix[ZBX-25526] made Zabbix agent 2 proc.num, proc.cpu.util, proc.get and proc.mem items behave consistently with Zabbix agent when non-existing user is specified (arimdjonoks)
fix[ZBX-26369] added ticket type parameter to OTRS CE media type, updated documentation, added missing web service file (drasikhov)
fix[ZBX-26297] improved server warning log message for out of order value identifier detection between Zabbix server and Zabbix proxy (rtrizna)
+6 more items in the release notesfeature[ZBXNEXT-9909] added Azure Backup Jobs by HTTP template (abrosimovs)
feature[ZBXNEXT-9905] updated max supported TimescaleDB version to 2.19 (mprihodko)
feature[ZBXNEXT-9813] added vm/hv UUID filter for vmware.datastore.discovery item (MVekslers)
feature[ZBXNEXT-9927] implemented masking of secret user macros that are explicitly used (mprihodko)
feature[ZBXNEXT-9937] updated PostgreSQL templates to support versions 17 and above (drasikhov)
fix[ZBX-26259] fixed issue of event created from trigger prototypes missing tags inherited from templates (arimdjonoks)
fix[ZBX-26270] fixed database sync error after removing interface used by item (sboidenko)
fix[ZBX-26319] fixed timeout in remote script execution to use TrapperTimeout instead of 60 s (askolmeisters)
fix[ZBX-25402] fixed numbered user macro parsing in macro function (askolmeisters)
fix[ZBX-26050] updated dashboards in Zabbix server/proxy health templates (aiantsen)
fix[ZBX-26390] updated templated dashboard help icon link (Sasha)
fix[ZBX-25691] fixed the Problems by severity widget to display all existing problems (wczerneha)
fix[ZBX-25931] updated LLD filters in Systemd by Zabbix agent 2 template (drasikhov)
fix[ZBX-26292] fixed typo in script items for family of Nutanix templates (akotsegubov)
fix[ZBX-24341] fixed {HOST.CONN}, {HOST.DNS}, {HOST.IP}, and {HOST.PORT} macros to be properly resolved in HTTP agent item fields (asestakovs)
fix[ZBX-23996] fixed errors in Item value widget when change indicator was displayed without value (dfofanovs)
fix[ZBX-26198] filtered out items that do not affect interface availability status (dfofanovs)
fix[ZBX-26298] fixed expansions of all further user macros after undefined user macro (sboidenko)
fix[ZBX-26335] fixed trigger expression in Azure SQL Managed Instance by HTTP template (abrosimovs)
fix[ZBX-26235] fixed Zabbix server crash caused by audit when autoregistration deletes host tags (arimdjonoks)
otherZABBIX 7.0.12
otherZABBIX 7.0.11rc2
securityFixes CVE-2024-45700: Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an…
otherZABBIX 7.0.10
securityFixes CVE-2024-42325: Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.
securityFixes CVE-2024-36469: Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.
otherZABBIX 7.0.9