Is CVE-2026-40080 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40080 being exploited in the wild.

How severe is CVE-2026-40080?

Medium severity, with a CVSS score of 6.1, published 25 June 2026.

Is there a fix for CVE-2026-40080?

A patch was published on 2026-04-26: Fix merged into 1.2.x branch via PR #7054 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40080 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40080?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40080: Cacti open redirect in auth_login_redirect

CVE-2026-40080 · Severity: medium · CVSS 6.1 · Published 2026-06-25

Cacti, an open-source network monitoring and fault management framework, is vulnerable to an open redirect flaw during the login process. By tricking a user into clicking a specially crafted link, an attacker can redirect the user to a malicious external website immediately after they log in. This can be used in phishing campaigns to steal credentials or deliver malware by making the malicious site appear to be a legitimate part of the Cacti application.

Quick answers

Is CVE-2026-40080 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40080 being exploited in the wild.
How severe is CVE-2026-40080?: Medium severity, with a CVSS score of 6.1, published 25 June 2026.
Which products and versions are affected?: Cacti Group Cacti <= 1.2.30.
Is there a fix for CVE-2026-40080?: A patch was published on 2026-04-26: Fix merged into 1.2.x branch via PR #7054 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40080 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40080?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability exists in Cacti's `auth_login_redirect()` function within `lib/auth.php`. The vulnerability stems from using a simple substring check (`str_contains`) on the `HTTP_REFERER` header against the `CACTI_PATH_URL` constant, rather than performing a proper host validation. If a user's profile is configured to redirect to the referer after login (`login_opts == '1'`), an attacker can provide a referer like `https://evil.com/cacti/` to bypass the check and force a redirection to an external domain. The fix, introduced in version 1.2.31, replaces the substring check with the `validate_redirect_url()` helper function which properly parses URLs and filters external hostnames.

Affected products

Cacti Group Cacti <= 1.2.30

Timeline

2026-04-26: patched: Fix merged into 1.2.x branch via PR #7054
2026-06-15: advisory: Release of version 1.2.31 containing the fix
2026-06-25: disclosed: CVE-2026-40080 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.