Insufficient Input Sanitization in Zabbix Agent 2 Docker Plugin
CVE-2026-23924

6.1MEDIUM

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
24 March 2026

What is CVE-2026-23924?

The Zabbix Agent 2 Docker plugin is vulnerable due to improper sanitization of the 'docker.container_info' parameters when these are forwarded to the Docker daemon. This flaw allows an attacker with access to invoke Agent 2 to read arbitrary files from running Docker containers by exploiting the Docker archive API, potentially leading to sensitive data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Zabbix 6.0.0 <= 6.0.43

Zabbix 7.0.0 <= 7.0.22

Zabbix 7.4.0 <= 7.4.6

References

https://support.zabbix.com/browse/ZBX-27642

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zabbix wants to thank kelsier from clocktwice.com for submitting this report on the HackerOne bug bounty platform.
JSON
.