CVE-2026-23924 Zabbix CVE debrief

Who should care

Defenders responsible for Zabbix Agent 2 deployments, especially those using the Docker plugin, should assess exposure and prioritize verification and potential updates. This includes reviewing current configurations, monitoring for suspicious activity, and ensuring that appropriate mitigations are in place. Security teams and vulnerability management teams should also be aware of the potential impacts and plan accordingly.

Why it matters

CVE-2026-23924 allows attackers with Agent 2 invocation access to read arbitrary files from running Docker containers. Defenders should verify exposure, prioritize updates, and monitor for suspicious activity.

• Potential unauthorized file reads from Docker containers via injected Docker archive API requests.
• Possible data breaches if sensitive files are accessible and read.
• Need for verification of affected versions and exposure in Zabbix Agent 2 deployments.
• Potential for attackers to gain insights into containerized environments.

Technical summary

The Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API. This issue affects Zabbix versions 6.0.0 to 6.0.44, 7.0.0 to 7.0.23, and 7.4.0 to 7.4.7. The vulnerability is due to insufficient input validation and sanitization of user-supplied data. Defenders should prioritize verifying exposure in Zabbix Agent 2 deployments, especially those using the Docker plugin.

Defensive priority

Defenders should prioritize verifying exposure in Zabbix Agent 2 deployments, especially those using the Docker plugin, and assess the need for updates or mitigations.

Recommended defensive actions

• Verify Zabbix Agent 2 Docker plugin usage and exposure in your environment.
• Check for and apply any available updates or patches from Zabbix.
• Monitor Docker container logs for suspicious activity.
• Restrict access to Agent 2 invocation to trusted users only.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Zabbix Agent 2 Docker plugin. Vendor advisory is available at support.zabbix.com. The vulnerability allows attackers with Agent 2 invocation access to read arbitrary files from running Docker containers. Evidence is based on CVE and NVD data, with limitations on source-provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.