CVE-2026-23924 — Argument Injection in Zabbix

CWE-88 — Argument Injection7 documents6 sources
Severity
6.1MEDIUMNVD
EPSS
0.1%
top 82.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Zabbix
Timeline
PublishedMar 24
Latest updateApr 6

Description

Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Affected Packages1 packages

▶CVEListV5zabbix/zabbix6.0.0 — 6.0.43+2

🔴Vulnerability Details

4
OSV
CVE-2026-23924: (Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker↗2026-04-06
▶
OSV
CVE-2026-23924: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker↗2026-03-24
▶
GHSA
GHSA-xfvx-fm25-g3v4: Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker↗2026-03-24
▶
CVEList
Agent 2 Docker plugin arbitrary file read via Docker API injection↗2026-03-24
▶

📋Vendor Advisories

1
Debian
CVE-2026-23924: zabbix - Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_in...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-23924 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-23924 — Argument Injection in Zabbix | cvebase