CVE-2026-39893: Cacti SQL Injection Vulnerability

CVE-2026-39893 Overview

CVE-2026-39893 is a pre-authentication SQL injection vulnerability in Cacti, an open source performance and fault management framework. The flaw exists in versions 1.2.30 and prior, where the rfilter request variable is concatenated directly into a RLIKE SQL clause without sanitization. The affected graph viewing endpoint does not require authentication when guest access is enabled, allowing unauthenticated attackers to inject arbitrary SQL. The Cacti maintainers fixed the issue in version 1.2.31.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the Cacti backend database, leading to full compromise of monitoring data, credential theft, and potential remote code execution paths.

Affected Products

Cacti versions 1.2.30 and prior
Cacti installations with guest user graph viewing enabled (pre-authentication exposure)
Cacti version 1.2.31 contains the fix

Discovery Timeline

2026-06-24 - CVE-2026-39893 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-39893

Vulnerability Analysis

The vulnerability is a SQL Injection (CWE-89) in the Cacti graph viewing functionality. The rfilter HTTP request parameter is appended directly into a SQL RLIKE regular-expression clause without parameterization or input validation. Because the affected endpoint supports guest access through Cacti's configured guest user, deployments that enable guest graph viewing expose the injection point without any authentication requirement. Attackers can manipulate the SQL statement to extract data, modify records, or escalate access depending on the underlying database privileges granted to the Cacti service account.

Root Cause

The root cause is direct string concatenation of attacker-controlled input into a SQL RLIKE predicate. Cacti's developers did not apply prepared statements or input sanitization to the rfilter variable before incorporating it into the query. The use of RLIKE rather than a simpler equality comparison broadens the syntactic surface an attacker can abuse to break out of the intended pattern and inject additional SQL clauses.

Attack Vector

The attack vector is remote and network-based. An attacker sends a crafted HTTP request to the vulnerable graph viewing endpoint containing a malicious rfilter value. On installations where guest viewing is enabled, no credentials are needed. The injected payload executes within the context of Cacti's database connection, enabling extraction of usernames, password hashes, device credentials, SNMP community strings, and other sensitive monitoring data stored by Cacti. See the Cacti Security Advisory GHSA-69gg-mjfm-jjpc and the upstream pull request for the precise code path and patch diff.

Detection Methods for CVE-2026-39893

Indicators of Compromise

HTTP requests to Cacti graph endpoints containing suspicious rfilter parameter values with SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences (--, #).
Unexpected access by the configured guest user account to graph viewing URLs followed by anomalous database query patterns.
Database error messages or stack traces referencing RLIKE syntax errors in Cacti web server logs.

Detection Strategies

Inspect web server access logs for requests to Cacti graph viewer endpoints where the rfilter query parameter contains URL-encoded SQL operators or boolean-based blind injection payloads.
Deploy web application firewall rules to flag SQL injection signatures targeting Cacti URIs, particularly any parameter feeding into RLIKE clauses.
Correlate sudden spikes in MySQL or MariaDB query volume from the Cacti application user with inbound HTTP traffic to graph endpoints.

Monitoring Recommendations

Enable database query logging for the Cacti service account and alert on queries containing union-based or time-based injection patterns.
Monitor authentication and authorization events for the Cacti guest user and disable guest access where it is not strictly required.
Track outbound connections from the Cacti host that could indicate post-exploitation data exfiltration following a successful injection.

How to Mitigate CVE-2026-39893

Immediate Actions Required

Upgrade Cacti to version 1.2.31 or later, which contains the sanitization fix for the rfilter parameter.
Disable guest graph viewing on internet-exposed Cacti instances until the upgrade is verified in production.
Audit the Cacti database for unauthorized modifications and rotate any credentials, SNMP community strings, and API tokens stored in Cacti.

Patch Information

Cacti version 1.2.31 resolves CVE-2026-39893. The fix is described in the Cacti GitHub Security Advisory GHSA-69gg-mjfm-jjpc and implemented in pull request #7039. Administrators should validate upgrade integrity and verify the patched code path before re-enabling any guest functionality.

Workarounds

Disable the Cacti guest user account or remove its graph viewing permissions to eliminate the pre-authentication exposure.
Restrict access to the Cacti web interface using network-level controls such as VPN, IP allow-listing, or reverse-proxy authentication.
Deploy WAF rules that block requests containing SQL injection payloads in the rfilter parameter on Cacti graph endpoints.

bash

# Configuration example: disable guest access at the reverse proxy level
# (nginx example restricting Cacti to authenticated VPN subnet)
location /cacti/ {
    allow 10.10.0.0/16;   # internal admin VLAN
    deny  all;
    proxy_pass http://cacti_backend;
}