CVE-2026-23924: 
Zabbix Server vulnerability analysis and mitigation

CVE-2026-23924 is a parameter injection and path traversal vulnerability in the Zabbix Agent 2 Docker plugin that allows an attacker with the ability to invoke Agent 2 to read arbitrary files from running Docker containers. The flaw was disclosed on March 24, 2026, and affects Zabbix Agent 2 versions 6.0.0–6.0.43, 7.0.0–7.0.22, and 7.4.0–7.4.6. It carries a CVSS v4.0 base score of 6.1 (Medium), assigned by Zabbix (Zabbix Jira, Red Hat Advisory).

The root cause is improper neutralization of argument delimiters (CWE-88) combined with path traversal (CWE-22) in the Zabbix Agent 2 Docker plugin. Specifically, the docker.container_info key parameters are not sanitized before being forwarded to the Docker daemon, allowing an attacker to inject additional arguments that invoke the Docker archive API to retrieve arbitrary files from running containers. Exploitation requires the attacker to be able to query Agent 2 with malicious arguments in the docker.container_info key, which typically requires high privileges (PR:H in the CVSS vector), but no user interaction or special attack conditions are needed (Zabbix Jira, Red Hat Bugzilla).

Successful exploitation allows an attacker to read arbitrary files from running Docker containers, potentially exposing sensitive data such as application secrets, configuration files, credentials, and API keys stored within containerized environments. The vulnerability has a high sub-system confidentiality impact (SC:H), meaning data within Docker containers managed by the affected Agent 2 instance is at risk. There is no integrity or availability impact, but exposed credentials could facilitate lateral movement within the infrastructure (Zabbix Jira, Red Hat Advisory).

1. Identify target: Locate a Zabbix Agent 2 instance with the Docker plugin enabled and running an affected version (6.0.0–6.0.43, 7.0.0–7.0.22, or 7.4.0–7.4.6) that is network-accessible.
2. Obtain invocation access: Gain the necessary high-privilege access to query Zabbix Agent 2 (e.g., via Zabbix server credentials or direct agent access).
3. Craft malicious query: Construct a docker.container_info key query with injected parameters designed to abuse the Docker archive API, embedding path traversal sequences or additional API arguments targeting specific files within a running container.
4. Submit query to Agent 2: Send the crafted query to the Agent 2 instance over the network (default port 10050).
5. Retrieve file contents: The unsanitized parameters are forwarded to the Docker daemon, which returns the requested file contents from the target container, exposing sensitive data such as secrets or credentials (Zabbix Jira).

• Network: Unusual or unexpected queries to Zabbix Agent 2 (default TCP port 10050) containing docker.container_info keys with anomalous or encoded path-like strings or extra parameters.
• Logs: Zabbix Agent 2 logs showing docker.container_info requests with unexpected container IDs or file path arguments; Docker daemon logs recording archive API (/containers/{id}/archive) calls not initiated by normal monitoring workflows.
• Process: Docker daemon receiving archive API requests originating from the Zabbix Agent 2 process for files outside expected monitoring scope (e.g., /etc/passwd, /run/secrets/, application config files).

Zabbix has released patched versions addressing this vulnerability: 6.0.44 (for the 6.0.x branch), 7.0.23 (for the 7.0.x branch), and 7.4.7 (for the 7.4.x branch). Organizations should update Zabbix Agent 2 to the respective fixed version as the primary remediation. As interim mitigations, restrict access to Agent 2 invocation to only trusted administrators and service accounts, implement network segmentation to limit which hosts can communicate with Agent 2 instances, and monitor Docker API calls for suspicious parameter injection attempts (Zabbix Jira, Red Hat Advisory).

Red Hat tracked the vulnerability via Bugzilla (Bug 2450866) and published a security advisory, classifying it as medium severity. The ENISA European Vulnerability Database (EUVD) also catalogued the issue as EUVD-2026-14958. No significant public researcher commentary or social media discussion has been observed beyond standard vulnerability database entries (Red Hat Bugzilla, Red Hat Advisory).