A new GLPI Agent version is now available!
GLPI-Agent 1.20 has been released. You can download it on the GLPI Agent github project: https://github.com/glpi-project/glpi-agent/releases/tag/1.20
You can check changes details in the official online Changelog available here: https://github.com/glpi-project/glpi-agent/blob/1.20/Changes
This new version fixes the following security issues:
- [SECURITY - High] MySQL client option-file injection via unsanitized server-supplied credential fields (CVE-2026-TODO)
- [SECURITY - Low] Proxy plugin can allow any system
.xmlfile overwrite iflocal_storeis enabled
We strongly encourage you to update your agents.
Bug fixes and enhancements
The release also includes some bug fixes and enhancements. Here are the more important ones:
- On MacOSX, a bug involving cpu usage overloading was fixed
- OAuth2 authentication credentials can be defined as a comma separated list to support more than one server target
- A windows network inventory regression was introduced in v1.19. This version fixes it.
- For netdiscovery/netinventory tasks:
- on windows, we fixed a cpu usage overloading due to iec61850 protocol support
- as a big optimization, glpi-agent will now test by default each device to know if it supports bulk snmp requests. This drastically reduces inventory time on big routers.
- inventory of Siemens devices with SNMP v3 credentials won’t no more fail on privacy protocol during netdiscovery when more than one possible credentials are tested
- New options are introduced to debug iec61850 protocol support
- For Proxy server plugin:
- Pending status are now fetched as expected when using chained glpi-agent proxies
- we fixed again XML content-type support for inventories sent by android agent as accidentally reverted in v1.17
- For ToolBox:
- Scheduled jobs are now planified as expected when service is started or restarted
Packaging
About packaging, here is what you should retain:
- On windows, GLPI Agent uses OpenSSL 3.5.8, updated building toolchain, libxml2 2.15.4, 7-zip v26.03, Glpi-AgentMonitor 1.5.1 and libssh2 1.11.1 patched for CVE-2025-15661, CVE-2026-7598, CVE-2026-55199, CVE-2026-55200, CVE-2026-58050, CVE-2026-58051, CVE-2026-66032, CVE-2026-66033, CVE-2026-66034 and CVE-2026-66035
- The MacOSX packaging now uses OpenSSL 3.5.8 and getaddrinfo native support is disabled in built perl to avoid crashes on tahoe
We strongly encourage you to update your agents to ensure optimal security and operational performance.
