Page 1 of 1
Domoticz version 2026.3 Released
Posted: Sunday 02 August 2026 12:32
by gizmocuz
Domoticz 2026.3 Released!
We’re happy to announce that
Domoticz version 2026.3 is now available!
This release brings a wide range of improvements, bug fixes, and performance enhancements to make your home automation setup even more reliable and efficient.
Read full release notes here:
https://www.domoticz.com/2026.3/
This release contains important security fixes
This release includes security fixes in the web server and API, including hardening of the OAuth2 authorize endpoint, an authorization fix for the udevices endpoint, authentication for WebSocket connections when website protection is enabled, and a broad hardening pass on the libwebem web server covering authentication, request parsing, proxy trust, HTTP framing, sessions and resource limits.
Upgrading is strongly recommended for everyone, and especially if your Domoticz is reachable from outside your home network. If it is, please also consider putting it behind a VPN rather than exposing it directly to the internet.
Our thanks go to the security researchers who reported these issues privately and gave us the time to fix them properly.
Some highlights
- Dynamic Dashboard: many additions and fixes, including a barometer trend graph, Stat Counter trends, more sensor types and Custom Sensor support in the Custom Chart widget, a Stop button and position slider for blinds, and precise numeric entry on the dial setpoint widget
- Charts and logs: 'week' range support for all sensor types in the JSON API, custom counter units in month/year graphs, and fixes to datapoint deletion and report date handling
- EvoHome: RAMSES-II HVAC ventilation support, exposing fan mode and speeds, CO2, air quality, humidity, temperatures, bypass position, air flow and filter/fault status
- MQTT Auto Discovery: better battery detection, Zigbee2MQTT 2.12 compatibility, force_update support, and select entities using value templates
- Netatmo: battery reporting and additional device scopes (note: existing users must re-select their scopes and re-authorize)
- Automation Wizard: selector level, alert device and user variable conditions
- Stability: fixes for a hardware start crash, a Python plugin deadlock, unresponsive cameras slowing the web interface, and duplicate rows from the nightly rollup
- Updated builtin SQLite to 3.53.4
Important: Backup First!
Before updating, please make a
FULL backup of your Domoticz folder
(or your SD card if you're running an embedded system).
This ensures you can always roll back to your previous version if needed.
Update Instructions
Option 1 – Update via the Web Interface
Setup->Check for Updates->Update
Option 2 – Update via command line
If you are on the
previous stable version, run the update command:
If you are on an
older beta version, use:
Option 3 – Run the install script
You can also rerun the installation script and choose
Update:
Code: Select all
sudo bash -c "$(curl -sSfL https://install.domoticz.com)"
Thanks
A big thank you to all volunteers who contributed to this release — we know it took a lot of effort and dedication!
We highly recommend updating to benefit from the latest fixes and improvements.
— The Domoticz Team
Re: Domoticz version 2026.3 Released
Posted: Sunday 02 August 2026 14:27
by rini52
Many thanks for the hard work.
Just used the docker domoticz/domoticz stable tag and it updated without any problems.
Best regards
Re: Domoticz version 2026.3 Released
Posted: Sunday 02 August 2026 15:51
by domovincent
Noticed since upgrade, no auth any more, even from the outside. I have setup some "Trusted networks" between a few servers, but with 2026.3, even on a mobile connection, there's no password being requested for clients.
[edit] Looks like the issue appears if you're using a reverse proxy which is in the "trusted networks" list. At least, that's what I can reverse engineer so far. Downgrading restores the login screen.
[edit2] Found it!
- New libwebem in commit 32fa8df.
- New libwebem ignores proxy headers by default. Forwarded headers are now ignored unless the new trusted_proxy_header_family setting is explicitly configured. Its new default is None.
- Domoticz does not configure this new header-family setting.
- Domoticz sees trusted proxy IP, and grants admin access without login.
[edit3] Create PR:
https://github.com/domoticz/domoticz/pull/6937
[edit4] The latest beta already fixes the security issue (About page states Compile Date 2026-08-02 18:55:45). Just installed and tested. X-Forwarded-For works as expected.
I love the new dynamic dashboard.
Re: Domoticz version 2026.3 Released
Posted: Sunday 09 August 2026 12:24
by janumix
Thanks a lot for Domoticz itself and new version, too !!!
Just a question, would it possible to preserve certs during upgrade script ? It's not a big deal to update then again but ...
Kind regards
Janusz
Re: Domoticz version 2026.3 Released
Posted: Sunday 09 August 2026 14:36
by Menno
I think the increased security prevents my Cheap Yellow Domoticx Display form connecting.
(CYD-Domoticz-Remote on github)
In the log I see:
Code: Select all
Status: [web:8080] Rejected WebSocket upgrade: Origin 'file://' is not allowed for a trusted-network session
Does this need fixing in the CYD code, or can I change something in my security settings?
Re: Domoticz version 2026.3 Released
Posted: Sunday 09 August 2026 17:25
by Thorgal789
Menno wrote: Sunday 09 August 2026 14:36
I think the increased security prevents my Cheap Yellow Domoticx Display form connecting.
(CYD-Domoticz-Remote on github)
In the log I see:
Code: Select all
Status: [web:8080] Rejected WebSocket upgrade: Origin 'file://' is not allowed for a trusted-network session
Does this need fixing in the CYD code, or can I change something in my security settings?
Hello, will be corrected in 1 Hour, on the "test" branch of CYD project.
Re: Domoticz version 2026.3 Released
Posted: Thursday 20 August 2026 13:53
by pierrotori
gizmocuz wrote: Sunday 02 August 2026 12:32
Upgrading is strongly recommended for everyone, and especially if your Domoticz is reachable from outside your home network. If it is, please also consider putting it behind a VPN rather than exposing it directly to the internet.
— The Domoticz Team
i listened you and put domoticz behing a VPN. i 'm connected with the local address http://local_address:8080 and i needed to put my user and my password, Is it normal ?
Re: Domoticz version 2026.3 Released
Posted: Thursday 20 August 2026 14:34
by jvdz
pierrotori wrote: Thursday 20 August 2026 13:53
gizmocuz wrote: Sunday 02 August 2026 12:32
Upgrading is strongly recommended for everyone, and especially if your Domoticz is reachable from outside your home network. If it is, please also consider putting it behind a VPN rather than exposing it directly to the internet.
— The Domoticz Team
i listened you and put domoticz behing a VPN. i 'm connected with the local address http://local_address:8080 and i needed to put my user and my password, Is it normal ?
Maybe not the right place to ask a question, but it all depends on what you defined in the trusted networks field on the Security tab.
My assumption is that you will have a different IP for your VPN-connected devices than the local LAN IP range, so you need to add the VPN IP subnet to the trusted networks.
Re: Domoticz version 2026.3 Released
Posted: Thursday 20 August 2026 15:09
by pierrotori
thanks for the solution
Re: Domoticz version 2026.3 Released
Posted: Friday 21 August 2026 8:26
by Gravityz
Nice release.
running it ever since and is very stable
Re: Domoticz version 2026.3 Released
Posted: Monday 07 September 2026 21:10
by Filip
pierrotori wrote: Thursday 20 August 2026 15:09
thanks for the solution
I still have a problem with the change in behavior when using a reverse proxy (before the update to 2026.3 all worked well). My trusted networks are set to 192.168.1.*. Synogogy server (proxy) and domoticz RPI are running in the local network.
I have the reverse proxy configuration as defined in
https://wiki.domoticz.com/WebServer_Proxy#Synology_NAS.
Before the upgrade, all traffic coming through the reverse proxy was recognised as "untrusted" (as it should be - asking for a login). After the upgrade, all traffic through the proxy is recoginised as "trusted" (so no login anymore).
A test I did: when I put my mobile in 5G only (so no local network - I checked the IP of my mobile and it has 100.x.x.x) and I connect through the proxy, I see in the log Status: [web:443] Incoming connection from: 192.168.1.67, 192.168.1.67 the local IP of my synology... This means that te external IP addres of my mobile (100.x.x.x) is not read by domoticz.
Am I doing something fundamentally wrong? Of has something changed in reading the custom headers information?
Re: Domoticz version 2026.3 Released
Posted: Tuesday 08 September 2026 8:28
by jannl
Isn't that the idea of the proxy? Hide the IP?
I had the same behaviour before and after the upgrade from 2026.2 to 2026.3
What is the setting of the reverse proxy header in de Domoticz settings?
Re: Domoticz version 2026.3 Released
Posted: Wednesday 09 September 2026 7:55
by sylvainsjc
Hi
Following on from Filip's report above - I think there might be a second, separate IP-visibility regression in 2026.3, this time on direct (non-proxied) connections.
My setup has no reverse proxy, Domoticz is directly reachable. Before 2026.3 I used to see this line whenever a malformed/scanning request hit the web server:
`Error: Error parsing http request address: <IP>`
I relied on it with fail2ban to ban repeat offenders. Since upgrading to 2026.3-stable, that line has completely disappeared - even when I deliberately send malformed requests that still get a correct `400 Bad Request` response, so the parser itself is clearly still working, it just isn't logging the event with the source IP anymore.
I also tried enabling Debug "Authentication" (Setup > Settings > Log) hoping to catch the IP through a different log path, but failed auth attempts show up there without any IP address either.
So between this and Filip's proxy case, it looks like the libwebem rewrite in 2026.3 touched IP handling/logging more broadly than just the proxy trust fix. Would be great to know if there's a way to get the source IP back in the logs for these cases - a lot of fail2ban setups on this forum depend on it.
Config: Domoticz V2026.3-stable, Raspberry Pi 5, no reverse proxy.
Re: Domoticz version 2026.3 Released
Posted: Wednesday 09 September 2026 8:48
by gizmocuz
If you want to chat about this, better to create a new topic for it as this issue will soon be deleted when there is a new version released.
(probably in a about 1.5 weeks)
Domoticz 2026.3 Released!
Read full release notes here:
This release contains important security fixes
Some highlights
Important: Backup First!
Update Instructions
Thanks