Domoticz version 2026.3 Released

[gizmocuz]

Domoticz 2026.3 Released!

We’re happy to announce that Domoticz version 2026.3 is now available!

This release brings a wide range of improvements, bug fixes, and performance enhancements to make your home automation setup even more reliable and efficient.

Read full release notes here:

https://www.domoticz.com/2026.3/

This release contains important security fixes

This release includes security fixes in the web server and API, including hardening of the OAuth2 authorize endpoint, an authorization fix for the udevices endpoint, authentication for WebSocket connections when website protection is enabled, and a broad hardening pass on the libwebem web server covering authentication, request parsing, proxy trust, HTTP framing, sessions and resource limits.

Upgrading is strongly recommended for everyone, and especially if your Domoticz is reachable from outside your home network. If it is, please also consider putting it behind a VPN rather than exposing it directly to the internet.

Our thanks go to the security researchers who reported these issues privately and gave us the time to fix them properly.

Some highlights

• Dynamic Dashboard: many additions and fixes, including a barometer trend graph, Stat Counter trends, more sensor types and Custom Sensor support in the Custom Chart widget, a Stop button and position slider for blinds, and precise numeric entry on the dial setpoint widget
• Charts and logs: 'week' range support for all sensor types in the JSON API, custom counter units in month/year graphs, and fixes to datapoint deletion and report date handling
• EvoHome: RAMSES-II HVAC ventilation support, exposing fan mode and speeds, CO2, air quality, humidity, temperatures, bypass position, air flow and filter/fault status
• MQTT Auto Discovery: better battery detection, Zigbee2MQTT 2.12 compatibility, force_update support, and select entities using value templates
• Netatmo: battery reporting and additional device scopes (note: existing users must re-select their scopes and re-authorize)
• Automation Wizard: selector level, alert device and user variable conditions
• Stability: fixes for a hardware start crash, a Python plugin deadlock, unresponsive cameras slowing the web interface, and duplicate rows from the nightly rollup
• Updated builtin SQLite to 3.53.4

Important: Backup First!

Before updating, please make a FULL backup of your Domoticz folder
(or your SD card if you're running an embedded system).

This ensures you can always roll back to your previous version if needed.

Update Instructions

Option 1 – Update via the Web Interface

Setup->Check for Updates->Update

Option 2 – Update via command line

If you are on the previous stable version, run the update command:

Code: Select all

cd domoticz
./updaterelease

If you are on an older beta version, use:

Code: Select all

cd domoticz
./updatebeta

Option 3 – Run the install script

You can also rerun the installation script and choose Update:

Code: Select all

sudo bash -c "$(curl -sSfL https://install.domoticz.com)"

Thanks

A big thank you to all volunteers who contributed to this release — we know it took a lot of effort and dedication!

We highly recommend updating to benefit from the latest fixes and improvements.

— The Domoticz Team

[rini52]

Many thanks for the hard work.

Just used the docker domoticz/domoticz stable tag and it updated without any problems.

Best regards

[domovincent]

Noticed since upgrade, no auth any more, even from the outside. I have setup some "Trusted networks" between a few servers, but with 2026.3, even on a mobile connection, there's no password being requested for clients.

[edit] Looks like the issue appears if you're using a reverse proxy which is in the "trusted networks" list. At least, that's what I can reverse engineer so far. Downgrading restores the login screen.

[edit2] Found it!
- New libwebem in commit 32fa8df.
- New libwebem ignores proxy headers by default. Forwarded headers are now ignored unless the new trusted_proxy_header_family setting is explicitly configured. Its new default is None.
- Domoticz does not configure this new header-family setting.
- Domoticz sees trusted proxy IP, and grants admin access without login.

[edit3] Create PR: https://github.com/domoticz/domoticz/pull/6937

[edit4] The latest beta already fixes the security issue (About page states Compile Date 2026-08-02 18:55:45). Just installed and tested. X-Forwarded-For works as expected.


I love the new dynamic dashboard.

[janumix]

Thanks a lot for Domoticz itself and new version, too !!!
Just a question, would it possible to preserve certs during upgrade script ? It's not a big deal to update then again but ...

Kind regards
Janusz

[Menno]

I think the increased security prevents my Cheap Yellow Domoticx Display form connecting.
(CYD-Domoticz-Remote on github)
In the log I see:

Code: Select all

Status: [web:8080] Rejected WebSocket upgrade: Origin 'file://' is not allowed for a trusted-network session

Does this need fixing in the CYD code, or can I change something in my security settings?

[Thorgal789]

I think the increased security prevents my Cheap Yellow Domoticx Display form connecting.
(CYD-Domoticz-Remote on github)
In the log I see:

Code: Select all

Status: [web:8080] Rejected WebSocket upgrade: Origin 'file://' is not allowed for a trusted-network session

Does this need fixing in the CYD code, or can I change something in my security settings?

Hello, will be corrected in 1 Hour, on the "test" branch of CYD project.

[pierrotori]

Upgrading is strongly recommended for everyone, and especially if your Domoticz is reachable from outside your home network. If it is, please also consider putting it behind a VPN rather than exposing it directly to the internet.

— The Domoticz Team

i listened you and put domoticz behing a VPN. i 'm connected with the local address http://local_address:8080 and i needed to put my user and my password, Is it normal ?

[jvdz]

Upgrading is strongly recommended for everyone, and especially if your Domoticz is reachable from outside your home network. If it is, please also consider putting it behind a VPN rather than exposing it directly to the internet.

— The Domoticz Team

i listened you and put domoticz behing a VPN. i 'm connected with the local address http://local_address:8080 and i needed to put my user and my password, Is it normal ?

Maybe not the right place to ask a question, but it all depends on what you defined in the trusted networks field on the Security tab.
My assumption is that you will have a different IP for your VPN-connected devices than the local LAN IP range, so you need to add the VPN IP subnet to the trusted networks.

[pierrotori]

thanks for the solution

[Gravityz]

Nice release.
running it ever since and is very stable

[Filip]

thanks for the solution

I still have a problem with the change in behavior when using a reverse proxy (before the update to 2026.3 all worked well). My trusted networks are set to 192.168.1.*. Synogogy server (proxy) and domoticz RPI are running in the local network.

I have the reverse proxy configuration as defined in https://wiki.domoticz.com/WebServer_Proxy#Synology_NAS.

Before the upgrade, all traffic coming through the reverse proxy was recognised as "untrusted" (as it should be - asking for a login). After the upgrade, all traffic through the proxy is recoginised as "trusted" (so no login anymore).

A test I did: when I put my mobile in 5G only (so no local network - I checked the IP of my mobile and it has 100.x.x.x) and I connect through the proxy, I see in the log Status: [web:443] Incoming connection from: 192.168.1.67, 192.168.1.67 the local IP of my synology... This means that te external IP addres of my mobile (100.x.x.x) is not read by domoticz.

Am I doing something fundamentally wrong? Of has something changed in reading the custom headers information?

[jannl]

Isn't that the idea of the proxy? Hide the IP?

I had the same behaviour before and after the upgrade from 2026.2 to 2026.3

What is the setting of the reverse proxy header in de Domoticz settings?

[sylvainsjc]

Hi
Following on from Filip's report above - I think there might be a second, separate IP-visibility regression in 2026.3, this time on direct (non-proxied) connections.

My setup has no reverse proxy, Domoticz is directly reachable. Before 2026.3 I used to see this line whenever a malformed/scanning request hit the web server:

`Error: Error parsing http request address: <IP>`

I relied on it with fail2ban to ban repeat offenders. Since upgrading to 2026.3-stable, that line has completely disappeared - even when I deliberately send malformed requests that still get a correct `400 Bad Request` response, so the parser itself is clearly still working, it just isn't logging the event with the source IP anymore.

I also tried enabling Debug "Authentication" (Setup > Settings > Log) hoping to catch the IP through a different log path, but failed auth attempts show up there without any IP address either.

So between this and Filip's proxy case, it looks like the libwebem rewrite in 2026.3 touched IP handling/logging more broadly than just the proxy trust fix. Would be great to know if there's a way to get the source IP back in the logs for these cases - a lot of fail2ban setups on this forum depend on it.

Config: Domoticz V2026.3-stable, Raspberry Pi 5, no reverse proxy.

[gizmocuz]

If you want to chat about this, better to create a new topic for it as this issue will soon be deleted when there is a new version released.
(probably in a about 1.5 weeks)