Visit ushttps://checkmarx.com/checkmarx-dast
For the latest DAST+ZAP official release
docker pull checkmarx/dast:latest
Copy For the latest DAST+ZAP-WEEKLY release
docker pull checkmarx/dast:weekly-latest
Copy DAST CLI can be used to scan and to generate a configuration file:
The CLI can perform these commands:
web: crawl a website to generate a list of endpoints to attack
api: attack a list of known endpoints
Scan API Requirements, when scanning an API using Docker Hub, the following conditions apply:
Mandatory Requirement: You must specify one of the following flags:
--openapi: Use this flag to indicate the OpenAPI specification file.
--postman: Alternatively, use this flag to specify the Postman collection file.
Exclusive Usage: Only one of the following flags is allowed per API scan:
Note: The flags --openapi and --postman can only be used with the API scan type.
--e CX_APIKEY API-key generated from CxOne for a specific user
-v Mounting the work-folder. The configuration file must be mounted
checkmarx/dast:latest Specify the docker-image: “name:tag”
web/api Specify the scan type: "api" or "web". When selecting "api", include the OpenAPI file using the "openapi" flag
Copy --environment-id The environment-id to which the scan will be associated with
--configFull Path of the configuration (yaml) file. The file must have r/w permission to all users
--base-url Address of the CxOne environment
--output The Engine’s output folder. The path MUST have r/w permission to all users
--openapi Relevant only for “api” scans. Path to the OpenAPI file (cannot be provided with postman flag)
--postman Relevant only for “api” scans. Path to the Postman collection file (cannot be provided with openapi flag)
--timeout Recommended – set timeout (seconds) for the scan. Current hard limit is 24 hours
Copy
Generate -OBSOLETE since 2.3.19
$ docker run checkmarx/dast:latest help
Copy Use "docker run checkmarx/dast [command] --help" for more information about a specific command.
DAST-CLI 2.3.70 with ZAP_WEEKLY_D-2026-07-21
ZAP&DAST-CLI now support the new client-spider
Print results by severity according to the by path/vulnerability toggle.
In addition, the fail-on flag should fail according to the same results.
Enable scanning of sites that enforce old SSL/TLS protocols and/or old cipher algorithms
PTK is currently disabled for all scansfor guided scans
Passing a Puppeteer recording int the --recording-path flag is currently not working
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.69 with ZAP_WEEKLY_D-2026-07-06
ZAP now supports the new client-spider (custom config only)
Fixed input validation for API files when performing env-setup
Fix OAuth auth in setup command
PTK is currently disabled for all scansfor guided scans
Passing a Puppeteer recording int the --recording-path flag is currently not working
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.68 with ZAP_WEEKLY_D-2026-07-06
ZAP now supports the new client-spider
New flag for the scan command: --browser (firefox-headless|chrome-headless) will instruct ZAP to use a specific browser. The new flag does not apply to web or api commands
Support using chrome browser instead Firefox.
The docker run command must include this flag (before the image name): --shm-size=2g
PTK is currently disabled for all scansfor guided scans
Passing a Puppeteer recording int the --recording-path flag is currently not working
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.67 with ZAP_WEEKLY_D-2026-06-09
Fix handling of GraphQL API files
Fix handling of client-side recordings for guided scans
Passing a Puppeteer recording int the --recording-path flag is currently not working
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.66 with ZAP_WEEKLY_D-2026-04-14
OS/ARCH: linux/amd64, linux/arm64
Fix API mismatch with Single-tenant environments causing scans to fail
DAST-CLI 2.3.65-HF1 with ZAP_WEEKLY_D-2026-03-31
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.65 with ZAP_WEEKLY_D-2026-03-31
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.64 with ZAP_WEEKLY_D-2026-03-18
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.63 with ZAP_WEEKLY_D-2026-03-09
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.62 with ZAP_WEEKLY_D-2026-03-02
Fixed bug in handling environment settings
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.61 with ZAP_WEEKLY_D-2026-03-02
ZAP is now compiled for Java21, and will not run on older JDKs
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.60 with ZAP_WEEKLY_D-2026-02-23
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.59 with ZAP_WEEKLY_D-2026-02-16
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.58 with ZAP_WEEKLY_D-2026-02-02
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.57 with ZAP_WEEKLY_D-2026-01-28
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.56 with ZAP_WEEKLY_D-2026-01-12
Rollback of ZAP version
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.55 with ZAP_WEEKLY_D-2026-01-21
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.54 with ZAP_WEEKLY_D-2026-01-12
Improved support for include-paths in the DAST-CLI
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.53 with ZAP_WEEKLY_D-2026-01-12
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.52 with ZAP_WEEKLY_D-2026-01-05
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.50 with ZAP_WEEKLY_D-2025-12-29
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.49 with ZAP_WEEKLY_D-2025-12-23
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.48 with ZAP_WEEKLY_D-2025-12-23
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.47 with ZAP_WEEKLY_D-2025-12-23
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.46 with ZAP_WEEKLY_D-2025-12-09
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.45 with ZAP_WEEKLY_D-2025-12-03
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.44 with ZAP_WEEKLY_D-2025-11-24
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.43 with ZAP_WEEKLY_D-2025-11-17
OS/ARCH: linux/amd64, linux/arm64
ZAP scans that ends with warnings should no longer be labeled as failed
DAST-CLI 2.3.36 with ZAP_WEEKLY_D-2025-10-14
OS/ARCH: linux/amd64, linux/arm64
ZAP scans that ends with warnings should no longer be labeled as failed
DAST-CLI 2.3.42 with ZAP_WEEKLY_D-2025-11-10
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.41 with ZAP_WEEKLY_D-2025-11-04
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.40 with ZAP_WEEKLY_D-2025-10-29
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.39 with ZAP_WEEKLY_D-2025-10-27
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.38 with ZAP_WEEKLY_D-2025-10-21
OS/ARCH: linux/amd64, linux/arm64
ZAP scans that ends with warnings should no longer be labeled as failed
DAST-CLI 2.3.36 with ZAP_WEEKLY_D-2025-10-14
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.35 with ZAP_WEEKLY_D-2025-10-14
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.24 with ZAP_WEEKLY_D-2025-10-06
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.22 with ZAP_WEEKLY_D-2025-09-29
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.21 with ZAP_WEEKLY_D-2025-09-22
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.20 with ZAP_WEEKLY_D-2025-09-15
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.19 with ZAP_WEEKLY_D-2025-09-15
The "generate" command is now obsolete
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.18 with ZAP_WEEKLY_D-2025-09-08
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.17 with ZAP_WEEKLY_D-2025-09-01
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.16 with ZAP_WEEKLY_D-2025-08-26
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.15 with ZAP_WEEKLY_D-2025-08-18
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.14 with ZAP_WEEKLY_D-2025-08-14
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.13 with ZAP_WEEKLY_D-2025-08-04
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.12 with ZAP_WEEKLY_D-2025-07-31
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.11 with ZAP_WEEKLY_D-2025-07-31
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.11 with ZAP_WEEKLY_D-2025-07-28
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.10 with ZAP_WEEKLY_D-2025-07-22
Improved collecting logs of authentication tests
Fixed a compatibility issue in the arm64 images
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.10 with ZAP_WEEKLY_D-2025-07-14
Improved collecting logs of authentication tests
Fixed a compatibility issue in the arm64 images
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.10 with ZAP_WEEKLY_D-2025-07-07
Improved collecting logs of authentication tests
Fixed a compatibility issue in the arm64 images
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.9 with ZAP_WEEKLY_D-2025-06-30
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.9 with ZAP_WEEKLY_D-2025-06-24
Support running with non-default (but not-admin) users
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.8 with ZAP_WEEKLY_D-2025-06-12
Small bug fixes
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.7 with ZAP_WEEKLY_D-2025-06-09
Small bug fixes
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.6 with ZAP_WEEKLY_D-2025-06-04
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.6 with ZAP_WEEKLY_D-2025-05-26
OS/ARCH: linux/amd64, linux/arm64
DAST-CLI 2.3.6 with ZAP_WEEKLY_D-2025-05-20
OS/ARCH: linux/amd64, linux/arm64
2.3.6-w2025-05-13 -OBSOLETE
DAST-CLI 2.3.6 with ZAP_WEEKLY_D-2025-05-13
OS/ARCH: linux/amd64, linux/arm64
2.3.6-w2025-05-12 -OBSOLETE
DAST-CLI 2.3.6 with ZAP_WEEKLY_D-2025-05-12
OS/ARCH: linux/amd64, linux/arm64
2.3.6-w2025-05-05 -OBSOLETE
DAST-CLI 2.3.6 with ZAP_WEEKLY_D-2025-05-05
OS/ARCH: linux/amd64, linux/arm64
2.3.6-w2025-04-24 -OBSOLETE
DAST-CLI 2.3.6 with ZAP_WEEKLY_D-2025-04-24
OS/ARCH: linux/amd64, linux/arm64
2.3.6 -OBSOLETE
DAST-CLI 2.3.6 with ZAP 2.16.1 + upgraded AddOns as of 8th April 2025
OS/ARCH: linux/amd64, linux/arm64
2.3.5 -OBSOLETE
DAST-CLI 2.3.5 with ZAP 2.16.1 + upgraded AddOns as of 25th March 2025
OS/ARCH: linux/amd64, linux/arm64
2.3.4 -OBSOLETE
DAST-CLI 2.3.4 with ZAP 2.16 + upgraded AddOns as of 10th March 25
Docker-image is now multi-arhitecture, suitable for (OS/ARCH) linux/amd64 and linux/arm64 platforms
2.3.3 -OBSOLETE
2.3.2 -OBSOLETE
DAST-CLI 2.3.2 with ZAP_WEEKLY_D-2024-11-04
Fixed Proxy settings for ZAP process
2.3.1-w2024-11-04 Pre-release -OBSOLETE
DAST-CLI 2.3.1 with ZAP_WEEKLY_D-2024-11-04
2.3.1 -OBSOLETE
Fixed permission issue when accessing internal files
2.3.0 -OBSOLETE
2.2.0 -OBSOLETE
Updating ZAP Engine to 2.15
Improved the worker logs
2.1.0 -OBSOLETE
New flag to API commands:
--postman: Optional flag that sets the path to the Postman collection file.
Scan API Requirements, when scanning an API using Docker Hub, the following conditions apply:
Mandatory Requirement: You must specify one of the following flags:
--openapi: Use this flag to indicate the OpenAPI specification file.
--postman: Alternatively, use this flag to specify the Postman collection file.
Exclusive Usage: Only one of the following flags is allowed per API scan:
2.0.1 -OBSOLETE
2.0.0 -OBSOLETE
Summary - This release addresses a high-security vulnerability identified in the previous versions of our Docker image
Key Changes - Security Fix: Closed a high-security issue to enhance the overall security and integrity of the image
Important Notice - Incompatibility with Previous Versions: Due to the importance of the security fix, users will no longer be able to work with previous Docker images. Please update to the latest version as soon as possible to ensure continued functionality and security.
We strongly recommend all users to pull the latest Docker image and discontinue the use of any previous versions to maintain a secure environment.
1.0.9 -OBSOLETE Versions 1.0.9 and older are OBSOLETE
* New flags to web and api commands:
* --poll-timeout: Optional - set the timeout (in seconds) for polling the results. Default - 600
* --poll-ticker: Optional - set the interval (in seconds) for polling the results. Default - 30
* Performance improvements
* Backward compatible