Zabbix 7.0.9 → 7.0.22
13 releases · 0 breaking changes · 9 security fixes · 9 advisories fixed
9security0breaking0deprecated25feature113fix
Vulnerabilities fixed by this upgrade
- 8.8 CVE-2026-23921 A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
- 6.0 CVE-2026-23919 For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no…
- 8.8 CVE-2026-23920 Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
- 8.1 CVE-2026-23925 An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
- 4.3 CVE-2025-49641 A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
- 4.9 CVE-2025-27231 The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
- 6.5 CVE-2025-27236 A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h…
- 3.5 CVE-2025-27238 Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
- 6.5 CVE-2024-45700 Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an…
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth… in 7.0.22
- security Fixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected… in 7.0.22
- security Fixes CVE-2026-23919: For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no… in 7.0.19
- security Fixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori… in 7.0.18
- security Fixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now… in 7.0.18
- security Fixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. in 7.0.18
- security Fixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h… in 7.0.17
- security Fixes CVE-2025-27238: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. in 7.0.14
- security Fixes CVE-2024-45700: Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an… in 7.0.10
Every release in between
securityFixes CVE-2026-23921: A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Alth…
securityFixes CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected…
fix[ZBX-27639] fixed regexp input validation to match whole input instead of per line match (askolmeisters)
fix[ZBX-27153] fixed undefined index error in SVG graphs for Zabbix agent active items (gcalenko)
fix[ZBX-27156] fix CPU spike in Zabbix agent 2 mysql plugin (esneiders)
feature[ZBXNEXT-10271] updated maximum supported TimescaleDB version to 2.22 (mprihodko)
feature[ZBXNEXT-10245] added Stormshield SNS by SNMP template (knaglis)
feature[ZBXNEXT-10219] updated maximum supported PostgreSQL version to 18 (mprihodko)
feature[ZBXNEXT-7744] added TLS support for Zabbix agent 2 Redis plugin (opucka)
fix[ZBX-27113] improved performance and memory usage by not storing item unsupported error in configuration cache (vso)
fix[ZBX-27111] fixed new timer being allocated each time trigger value is updated (vso)
fix[ZBX-26544] added preprocessing step to "Outbound packets discarded" item in FortiGate by SNMP template (aiantsen)
fix[ZBX-22157] added Map navigation tree widget problem filtering using "Problem display" and "Show suppressed problems" filters of map settings (dfofanovs)
fix[ZBX-27059] fixed conditions for "Cannot delete default MFA method" check (dpankins)
fix[ZBX-24504] improved Prometheus to JSON preprocessing step performance when reused with similar parameters in dependent items (wiper)
fix[ZBX-25743] fixed broken item selection list in Firefox (gklavins, wczerneha)
fix[ZBX-25148] added adjustments for sequential data entries with the same timestamp (askolmeisters)
fix[ZBX-25394] fixed unassigned proxy indication on Queue details page; extended coverage to proxies managed by proxy groups (dpankins)
fix[ZBX-25263] fixed Zabbix agent to attempt next refresh of active checks in 60 seconds in case of connection errors (arimdjonoks)
fix[ZBX-26910] fixed Zabbix server and Zabbix proxy compilation on macOS or with custom library paths (vso)
fix[ZBX-25741] eliminated difference in host group lists via "Select" button and via search typing (wczerneha)
fix[ZBX-26941] fixed duplicate entry error when new value arrive after Zabbix server finished syncing trends (vso)
fix[ZBX-26893] fixed delay when executing tasks through Zabbix proxy such as test item, check now, remote command (vso)
fix[ZBX-26459] fixed Host macros view to avoid displaying both macro types when switching quickly (gberzina)
fix[ZBX-26776] fixed ability to change widget in Pie chart widget data set (gberzina)
fix[ZBX-22625] fixed JavaScript in HPE Synergy by HTTP template (abrosimovs)
fix[ZBX-26069] implemented re-broadcast behavior for widgets on forced update (ashubin, wczerneha)
fix[ZBX-24918] fixed crashes of Zabbix agent 2 for Windows related to PDH perf_counter (opucka)
fix[ZBX-26755] fixed problem with Zabbix agent 2 MQTT plugin not establishing connection if first call failed (opucka)
fix[ZBX-16162] fixed classic graphs rendering when throttling is used (Sasha)
fix[ZBX-24046] fixed incorrect error message for ldap_jit_interval field in LDAP settings form (kkuzmina)
fix[ZBX-25038] fixed SCIM error message by adding mention of requested endpoint to it (kkuzmina)
fix[ZBX-26851] changed macro names in MSSQL templates (sbelakovs)
securityFixes CVE-2026-23919: For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (no…
feature[ZBXNEXT-10143] added "Highlight whole row" feature in non-compact mode in Problems (ashubin)
feature[ZBXNEXT-10106] extended preprocessor throughput monitoring in Zabbix server/proxy health templates (aiantsen)
feature[ZBXNEXT-9819] added new template Vyatta Virtual Router by SNMP (knaglis)
feature[ZBXNEXT-9933] added TNS name support for Zabbix agent 2 Oracle plugin (lsurvilo)
feature[ZBXNEXT-10107] improved device coverage in Huawei OceanStor Dorado by SNMP template (abrosimovs)
feature[ZBXNEXT-10123] added Aruba CX 8300s by SNMP template (akotsegubov)
feature[ZBXNEXT-10152] added new macro for disk discovery type selection in both SMART by Zabbix agent 2 templates (knaglis)
feature[ZBXNEXT-10027] prepared for removal of TimescaleDB API call deprecated since TimescaleDB 2.18.0 (jfreibergs)
feature[ZBXNEXT-10017] added Ciena 3906 by SNMP template (akotsegubov)
feature[ZBXNEXT-9255] updated Meraki templates to handle rate limit on API requests (aiantsen)
feature[ZBXNEXT-9902] changed timeout range for Zabbix JS and Zabbix get utilities (askolmeisters)
feature[ZBXNEXT-10077] updated maximum supported MariaDB version to 12.0 (mprihodko)
fix[ZBX-26419] improved performance of problem and event views by optimizing SQL queries to join only necessary triggers, eliminating redundant post-join filtering (vso)
fix[ZBX-25796] fixed confusing error message on item test timeout (isharha)
fix[ZBX-26337] removed unnecessary div elements for entries without problems in Item and Host navigator widgets (msnihach)
fix[ZBX-26873] fixed support for SSH item proxy through configurations in SSH configuration file (aetatsu)
fix[ZBX-19267] fixed wmi.get items sometimes incorrectly returning "Empty WMI search result" with Zabbix agent 2 (aetatsu)
fix[ZBX-20207] fixed unexpected interface connection mode change during autoregistration (vso)
fix[ZBX-25448] fixed token-based authentication method in FortiGate by HTTP template (egordymov)
fix[ZBX-26847] explicitly defined Oracle connection timezone in Zabbix agent 2 (opucka)
fix[ZBX-26472] fixed clearing of elements when imported file contains no background image or icon map (rgontarski)
fix[ZBX-26694] fixed media type test parameter maxlength (gberzina)
fix[ZBX-26416] fixed SNMP trap item processing issue after monitored host changes (sboidenko)
fix[ZBX-26801] fixed ability to select discovered items when editing graph items (gberzina)
fix[ZBX-20964] removed Problems link in Monitoring hosts page for user who does not have access (msnihach)
fix[ZBX-26621] added TLS host parameter update in autoregistration mode (vsmelovs)
fix[ZBX-26440] fixed inability to update JMX endpoint field in item, item prototype, and LLD forms (kkuzmina)
fix[ZBX-25041] improved configuration form validation in Graph and Pie chart widgets when referenced item widget is unavailable (isharha)
fix[ZBX-24720] fixed LDAP media type mapping "When active" field trimming (dpankins)
fix[ZBX-26892] fixed VMware Event Collector hangs in case of network errors (MVekslers)
fix[ZBX-26920] fixed wrong time in Zabbix agent for Windows (sboidenko)
fix[ZBX-25669] added trigger version check after upgrading to newer version (aluchko)
fix[ZBX-22786] fixed trends graph line color issue with PHP 8.1 (isharha)
fix[ZBX-26044] fixed Honeycomb widget not to display disabled items (rgontarski)
fix[ZBX-25540] fixed inconsistent link styling for dependent trigger prototypes (rgontarski)
fix[ZBX-26482] fixed TypeError after deleting datasets in Graph and Pie chart widgets (isharha)
fix[ZBX-26202] fixed inability to create "Execute now" tasks for users of Admin user type (jfreibergs)
fix[ZBX-24603] fixed MFA TOTP secrets not being deleted when deleting users from MFA-enabled user groups (agriscenko, jfreibergs)
fix[ZBX-25739] fixed timeleft() function to return 1.7976931348623157E+308 instead of making item unsupported in case of infinite time (arimdjonoks, averza)
+11 more items in the release notessecurityFixes CVE-2026-23925: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthori…
securityFixes CVE-2025-27231: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now…
securityFixes CVE-2025-49641: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
fix[ZBX-26868] fixed crash when adding new SNMP device (vso)
securityFixes CVE-2025-27236: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not h…
feature[ZBXNEXT-10119] improved preprocessing diagnostics by highlighting top item IDs with the longest processing times (vso)
fix[ZBX-26693] fixed high memory usage by excluding values without preprocessing from being sent to the preprocessing manager (vso)
fix[ZBX-26661] fixed deadlock on autoreg_host table (vso)
fix[ZBX-26589] fixed DNS queries being performed for IP addresses when using older c-ares library (vso)
fix[ZBX-26610] fixed some tasks being stuck in preprocessing queue (wiper)
fix[ZBX-26588] fixed finished tasks queue size tracking which caused high cpu utilization by preprocessing manager (wiper)
securityFixes CVE-2025-27238: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
feature[ZBXNEXT-9931] added top items sorted by received values number and size to diaginfo preprocessing section (asestakovs)
feature[ZBXNEXT-9942] added preprocessor throughput to Zabbix server health templates (aiantsen)
feature[ZBXNEXT-9989] added supergroup topics support to Telegram media type, updated documentation (drasikhov)
fix[ZBX-26988] fixed non-super admin user restriction working incorrectly for hostprototype.get api method (aluchko)
fix[ZBX-26537] fixed memory over-allocation in preprocessing manager (vso)
fix[ZBX-26422] added missing translation string for "Tags" label in "Tags" tab in configuration forms (solonkins)
fix[ZBX-26294] improved logic of SNMP cache cleanup (dgoloscapov)
fix[ZBX-25929] improved digital clock widget element sizing (apoga)
fix[ZBX-21087] fixed not all aggregation functions working with foreach functions (aluchko)
fix[ZBX-26191] fixed inconsistent API and frontend validation for maintenance period 'every' and 'period' fields (aluchko)
fix[ZBX-23167] fixed issues with Host dashboards not displaying widgets from inaccessible templates; added hostdashboard object API (jfreibergs, vmaksimovs)
fix[ZBX-26123] added hostid parameter validation in web scenario configuration form (msnihach)
fix[ZBX-25420] fixed regsub/iregsub returning output if there is no match (talbergs)
fix[ZBX-26446] fixed Zabbix agent 2 S.M.A.R.T plugin failing on non-fatal exit status codes (esneiders)
fix[ZBX-26426] fixed preprocessing to flush values for an item in the same order they were sent to preprocessing (wiper)
fix[ZBX-26529] fixed memory leak when global variables are used in JavaScript preprocessing (vso)
fix[ZBX-26469] fixed Zabbix proxy crash in discovery manager process (Andris, MVekslers)
fix[ZBX-26187] fixed response to wmi.getall from Zabbix agent 2 not returning array-type values (mprihodko)
fix[ZBX-25944] replaced container name with container ID where used in queries and items for both Oracle templates and Oracle Zabbix agent 2 plugin (knaglis)
fix[ZBX-26131] disabled the menu item "Create trigger prototype" for item prototypes with binary data type (msnihach)
fix[ZBX-26478] fixed Zabbix server crash when shutting down DB and sending alert using script media type with no parameters (askolmeisters)
fix[ZBX-26116] fixed overload in history cache by vmware.eventlog item (MVekslers)
fix[ZBX-25968] added configuration validation of DBPort and DBSocket (rtrizna)
fix[ZBX-26344] refactored zbxcmd execute to avoid windows syscalls in Zabbix agent 2 (esneiders)
fix[ZBX-26433] fixed values outside of history storage period causing trigger to cache all values in storage period (vso)
fix[ZBX-25175] increased retry to 5 for asynchronous SNMP pollers to avoid failure if one of packets is lost (vso)
fix[ZBX-26092] fixed Office 365 relay media type domain formatting to replace all dash symbols with dot (msnihach)
fix[ZBX-26313] fixed SNMP preprocessing causing item to be unsupported when encountering wrong type (dgoloscapov)
fix[ZBX-26387] fixed newline being truncated in SNMP "get[" check (dgoloscapov)
fix[ZBX-26372] fixed long-running TimescaleDB queries when requesting historical data (gcalenko, Sasha)
fix[ZBX-26339] fixed user macro resolving order in templates so that in case of conflict import order of templates takes precedence over the linking order (askolmeisters)
fix[ZBX-18703] removed preprocessing step for mounted fs discovery in VMware Guest template (akotsegubov)
fix[ZBX-25713] fixed the map navigation tree widget selection issue (wczerneha)
fix[ZBX-26466] added ability for generic users to open the templates popup (Sasha)
fix[ZBX-26244] fixed Zabbix agent 2 memory leak related to traffic compression (MVekslers)
fix[ZBX-26114] improved Zabbix agent 2 accept rate on high RTT (sjurgensons)
fix[ZBX-25526] made Zabbix agent 2 proc.num, proc.cpu.util, proc.get and proc.mem items behave consistently with Zabbix agent when non-existing user is specified (arimdjonoks)
fix[ZBX-26369] added ticket type parameter to OTRS CE media type, updated documentation, added missing web service file (drasikhov)
fix[ZBX-26297] improved server warning log message for out of order value identifier detection between Zabbix server and Zabbix proxy (rtrizna)
+6 more items in the release notesfeature[ZBXNEXT-9909] added Azure Backup Jobs by HTTP template (abrosimovs)
feature[ZBXNEXT-9905] updated max supported TimescaleDB version to 2.19 (mprihodko)
feature[ZBXNEXT-9813] added vm/hv UUID filter for vmware.datastore.discovery item (MVekslers)
feature[ZBXNEXT-9927] implemented masking of secret user macros that are explicitly used (mprihodko)
feature[ZBXNEXT-9937] updated PostgreSQL templates to support versions 17 and above (drasikhov)
fix[ZBX-26259] fixed issue of event created from trigger prototypes missing tags inherited from templates (arimdjonoks)
fix[ZBX-26270] fixed database sync error after removing interface used by item (sboidenko)
fix[ZBX-26319] fixed timeout in remote script execution to use TrapperTimeout instead of 60 s (askolmeisters)
fix[ZBX-25402] fixed numbered user macro parsing in macro function (askolmeisters)
fix[ZBX-26050] updated dashboards in Zabbix server/proxy health templates (aiantsen)
fix[ZBX-26390] updated templated dashboard help icon link (Sasha)
fix[ZBX-25691] fixed the Problems by severity widget to display all existing problems (wczerneha)
fix[ZBX-25931] updated LLD filters in Systemd by Zabbix agent 2 template (drasikhov)
fix[ZBX-26292] fixed typo in script items for family of Nutanix templates (akotsegubov)
fix[ZBX-24341] fixed {HOST.CONN}, {HOST.DNS}, {HOST.IP}, and {HOST.PORT} macros to be properly resolved in HTTP agent item fields (asestakovs)
fix[ZBX-23996] fixed errors in Item value widget when change indicator was displayed without value (dfofanovs)
fix[ZBX-26198] filtered out items that do not affect interface availability status (dfofanovs)
fix[ZBX-26298] fixed expansions of all further user macros after undefined user macro (sboidenko)
fix[ZBX-26335] fixed trigger expression in Azure SQL Managed Instance by HTTP template (abrosimovs)
fix[ZBX-26235] fixed Zabbix server crash caused by audit when autoregistration deletes host tags (arimdjonoks)
otherZABBIX 7.0.12
otherZABBIX 7.0.11rc2
securityFixes CVE-2024-45700: Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an…
otherZABBIX 7.0.10