CVE-2026-23924CWE-88

CVE-2026-23924

Medium · published March 24, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.7th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-03-24T23:16Z
Affected products (3)
ProductVersionsFixed in
zabbix/zabbix≥ 6.0.0, < 6.0.446.0.44
zabbix/zabbix≥ 7.0.0, < 7.0.237.0.23
zabbix/zabbix≥ 7.4.0, < 7.4.77.4.7
References (1)
https://support.zabbix.com/browse/ZBX-27642 · [email protected]
EPSS history
Timeline
  • 24 MAR 18:30Z
    Agent 2 Docker plugin arbitrary file read via Docker API injection
    cvelistv5