Is CVE-2026-46531 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46531 being exploited in the wild.

How severe is CVE-2026-46531?

Medium severity, with a CVSS score of 5.5, published 23 October 2026.

How is CVE-2026-46531 attacked?

It is attacked over the network.

Am I affected by CVE-2026-46531?

Check whether you run Cacti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46531: Cacti authenticated stored SQL injection in automation tree rule

CVE-2026-46531 · Severity: medium · CVSS 5.5 · Published 2026-10-23

Cacti is a web-based network monitoring and graphing application used by IT teams to track system performance. An authenticated administrator or user with automation permissions can inject arbitrary SQL code that gets executed when automation rules are applied, allowing them to extract sensitive data like user password hashes or other database contents. This requires the attacker to already have legitimate access to Cacti with automation privileges.

Technologies: Cacti. Vendors: Cacti.

Quick answers

Is CVE-2026-46531 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46531 being exploited in the wild.
How severe is CVE-2026-46531?: Medium severity, with a CVSS score of 5.5, published 23 October 2026.
Which products and versions are affected?: Cacti 1.2.27 to 1.2.30.
Is there a fix for CVE-2026-46531?: Yes: fixed in 1.2.31. Until then: Restrict the Automation realm permissions to only trusted administrators until patched, and avoid triggering the "Apply Automation Rules" bulk action (graphs.php?action=actions&drp_action=8) unless automation rules have been manually reviewed for suspicious field values. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46531 attacked?: It is attacked over the network.
Am I affected by CVE-2026-46531?: Check whether you run Cacti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.2.31

Restrict the Automation realm permissions to only trusted administrators until patched, and avoid triggering the "Apply Automation Rules" bulk action (graphs.php?action=actions&drp_action=8) unless automation rules have been manually reviewed for suspicious field values.

Technical details

A second-order SQL injection vulnerability exists in the automation tree rule item handler where unsanitized user input in the automation_tree_rule_items.field column is concatenated directly into a SELECT statement in lib/api_automation.php::create_all_header_nodes() without validation or escaping. An authenticated user with Automation realm permissions can persist a malicious SQL fragment via automation_tree_rules.php (lines 167-175) which uses an empty regex validation, bypassing the allowlist check present in sibling handlers. The injected query executes when an administrator applies automation rules through the bulk action graphs.php?action=actions&drp_action=8, with results written to graph_tree_items.title and rendered in the UI.

Affected products

Cacti Cacti 1.2.27 to 1.2.30

Timeline

2026-10-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.