# CVE-2026-46531: Cacti authenticated stored SQL injection in automation tree rule

Source: https://junglewise.ai/threats/cve-2026-46531-cacti-is-an-open-source-performance-and-fault-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-46531 · Severity: medium · CVSS 5.5 · Published 2026-10-23

Cacti is a web-based network monitoring and graphing application used by IT teams to track system performance. An authenticated administrator or user with automation permissions can inject arbitrary SQL code that gets executed when automation rules are applied, allowing them to extract sensitive data like user password hashes or other database contents. This requires the attacker to already have legitimate access to Cacti with automation privileges.

Technologies: [Cacti](https://junglewise.ai/threats/technologies/cacti). Vendors: [Cacti](https://junglewise.ai/threats/vendors/cacti).

## Quick answers

**Is CVE-2026-46531 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46531 being exploited in the wild.

**How severe is CVE-2026-46531?** Medium severity, with a CVSS score of 5.5, published 23 October 2026.

**Which products and versions are affected?** Cacti 1.2.27 to 1.2.30.

**Is there a fix for CVE-2026-46531?** Yes: fixed in 1.2.31. Until then: Restrict the Automation realm permissions to only trusted administrators until patched, and avoid triggering the "Apply Automation Rules" bulk action (graphs.php?action=actions&drp_action=8) unless automation rules have been manually reviewed for suspicious field values. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46531 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-46531?** Check whether you run Cacti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.2.31

Restrict the Automation realm permissions to only trusted administrators until patched, and avoid triggering the "Apply Automation Rules" bulk action (graphs.php?action=actions&drp_action=8) unless automation rules have been manually reviewed for suspicious field values.

## Technical details

A second-order SQL injection vulnerability exists in the automation tree rule item handler where unsanitized user input in the automation_tree_rule_items.field column is concatenated directly into a SELECT statement in lib/api_automation.php::create_all_header_nodes() without validation or escaping. An authenticated user with Automation realm permissions can persist a malicious SQL fragment via automation_tree_rules.php (lines 167-175) which uses an empty regex validation, bypassing the allowlist check present in sibling handlers. The injected query executes when an administrator applies automation rules through the bulk action graphs.php?action=actions&drp_action=8, with results written to graph_tree_items.title and rendered in the UI.

## Affected products

- Cacti Cacti 1.2.27 to 1.2.30

## Timeline

- 2026-10-23: disclosed

## References

- [https://github.com/Cacti/cacti/pull/7163](https://github.com/Cacti/cacti/pull/7163)
- [https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2](https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2)

## Related threats

- [Cacti user enumeration via error messages](https://junglewise.ai/threats/cve-2026-49442-cacti-is-an-open-source-performance-and-fault-management)
- [Cacti input string validation bypass and RCE](https://junglewise.ai/threats/cve-2026-39902-cacti-is-an-open-source-performance-and-fault-management)
- [Cacti package import signature validation bypass](https://junglewise.ai/threats/cve-2026-40941-cacti-package-import-signature-validation-bypass)
- [Cacti path traversal in Report format_file parameter](https://junglewise.ai/threats/cve-2026-40084-cacti-path-traversal-in-report-format-file-parameter)
- [Cacti SQL injection in managers.php](https://junglewise.ai/threats/cve-2026-40083-cacti-sql-injection-in-managers-php)