Executive brief
Cacti, an open-source network monitoring and fault management framework, contains a critical security flaw that allows unauthorized individuals to interfere with its database. By sending a specially crafted request to the system, an attacker can gain full access to sensitive data, modify records, or disrupt the monitoring service entirely. This vulnerability is particularly dangerous because it can be exploited over the network without needing a username or password.
Technical details
A pre-authentication SQL injection vulnerability exists in Cacti versions 1.2.30 and prior within the 'graph_view.php' component. The root cause is the use of an unanchored regular expression in the 'FILTER_VALIDATE_REGEXP' function, which fails to properly sanitize user-supplied input before it is used in a database query. A remote, unauthenticated attacker can exploit this by sending a malicious network request to the affected endpoint. Successful exploitation allows for arbitrary SQL command execution, potentially leading to full database compromise, data exfiltration, or service disruption. The vulnerability is addressed in version 1.2.31 through improved input validation and defense-in-depth hardening.
Affected products
- Cacti Cacti <= 1.2.30
Timeline
- 2026-06-19: advisory: GitHub Security Advisory GHSA-gp82-qhrg-crv7 published
- 2026-06-24: disclosed: CVE-2026-39955 published to NVD
- 2026-06-24: patched: Fix released in version 1.2.31