# CVE-2026-40941: Cacti package import signature validation bypass

Source: https://junglewise.ai/threats/cve-2026-40941-cacti-package-import-signature-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-40941 · Severity: info · CVSS 7.1 · Published 2026-06-25

Cacti, an open-source network monitoring and fault management framework, contains a security flaw in how it handles imported packages. The system fails to properly validate cryptographic signatures, which could allow an attacker to upload and install unauthorized or malicious "self-signed" packages. This could lead to unauthorized configuration changes or the introduction of malicious code into the monitoring environment.

Technologies: [Cacti](https://junglewise.ai/threats/technologies/cacti). Vendors: [Cacti](https://junglewise.ai/threats/vendors/cacti).

## Quick answers

**Is CVE-2026-40941 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40941 being exploited in the wild.

**How severe is CVE-2026-40941?** Informational severity, with a CVSS score of 7.1, published 25 June 2026.

**Which products and versions are affected?** Cacti <= 1.2.30.

**Is there a fix for CVE-2026-40941?** A patch was published on 2026-06-15: Version 1.2.31 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40941 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40941?** Check whether you run Cacti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Cacti's package import mechanism (lib/import.php) due to improper verification of cryptographic signatures (CWE-347). The flaw allows the system to accept self-signed packages that have not been verified against a trusted authority. An authenticated attacker with low privileges can exploit this bypass to import arbitrary packages, potentially leading to unauthorized modifications of the Cacti environment. This issue was addressed in version 1.2.31 by tightening package file allowlists and implementing anchored prefix policies for scripts and resources.

## Affected products

- Cacti Cacti <= 1.2.30

## Timeline

- 2026-06-15: patched: Version 1.2.31 released
- 2026-06-18: advisory: GitHub Security Advisory GHSA-274c-97hj-pv2v published
- 2026-06-25: disclosed: CVE-2026-40941 published to NVD

## References

- [https://github.com/Cacti/cacti/pull/7054](https://github.com/Cacti/cacti/pull/7054)
- [https://github.com/Cacti/cacti/releases/tag/release%2F1.2.31](https://github.com/Cacti/cacti/releases/tag/release%2F1.2.31)
- [https://github.com/Cacti/cacti/security/advisories/GHSA-274c-97hj-pv2v](https://github.com/Cacti/cacti/security/advisories/GHSA-274c-97hj-pv2v)

## Related threats

- [Cacti user enumeration via error messages](https://junglewise.ai/threats/cve-2026-49442-cacti-is-an-open-source-performance-and-fault-management)
- [Cacti authenticated stored SQL injection in automation tree rule](https://junglewise.ai/threats/cve-2026-46531-cacti-is-an-open-source-performance-and-fault-management)
- [Cacti input string validation bypass and RCE](https://junglewise.ai/threats/cve-2026-39902-cacti-is-an-open-source-performance-and-fault-management)
- [Cacti path traversal in Report format_file parameter](https://junglewise.ai/threats/cve-2026-40084-cacti-path-traversal-in-report-format-file-parameter)
- [Cacti SQL injection in managers.php](https://junglewise.ai/threats/cve-2026-40083-cacti-sql-injection-in-managers-php)