CVE-2026-23924 Agent 2 Docker plugin arbitrary file read via Docker API injection
An attacker can read arbitrary files from Docker containers by injecting parameters into the Zabbix Agent 2 Docker plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23924?
CVE-2026-23924 is a medium-severity path traversal vulnerability in Zabbix Zabbix, published on 24 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.
Weakness: CWE-88
Which versions are affected by CVE-2026-23924?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2026-23924?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-23924 being exploited?
There is no known exploitation of CVE-2026-23924 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2026-23924, GHSA-xfvx-fm25-g3v4, UBUNTU-CVE-2026-23924.