CVE-2026-39900: Cacti Reflected XSS Vulnerability

CVE-2026-39900 Overview

CVE-2026-39900 is a Reflected Cross-Site Scripting (XSS) vulnerability in Cacti, an open source performance and fault management framework. Versions 1.2.30 and prior fail to sanitize the tab parameter before reflecting it into a JavaScript context in auth_profile.php. An attacker can craft a malicious URL that executes arbitrary JavaScript in the browser of an authenticated Cacti user who follows it. The flaw is tracked under [CWE-79] and was fixed in Cacti 1.2.31.

Critical Impact
Successful exploitation lets an attacker execute JavaScript in the victim's session, enabling session theft, action hijacking, or pivoting deeper into the Cacti management interface.

Affected Products

Cacti versions 1.2.30 and prior
auth_profile.php endpoint (tab parameter)
Fixed in Cacti 1.2.31

Discovery Timeline

2026-06-24 - CVE-2026-39900 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-39900

Vulnerability Analysis

The vulnerability resides in auth_profile.php, where the tab query parameter is reflected directly into a JavaScript block on the rendered page. Because the value is emitted into a script context without contextual encoding, an attacker controls JavaScript syntax rather than HTML content. Browser-side HTML encoding alone does not neutralize the payload because the data flows through <script> boundaries. The bug is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

The EPSS score is 0.268% (18.285 percentile), reflecting low observed exploitation likelihood, but reflected XSS in a network monitoring console remains attractive for targeted phishing of administrators.

Root Cause

The tab parameter received from the request is interpolated into inline JavaScript within auth_profile.php without JavaScript-context escaping or strict allowlist validation. A crafted value can terminate the surrounding string or expression and inject attacker-controlled script that executes under the Cacti origin.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker delivers a crafted URL containing a malicious tab value to an authenticated Cacti user, typically via email, chat, or a referring page. When the user loads the URL, the injected JavaScript runs in the context of the Cacti web application, allowing the attacker to read DOM contents, issue authenticated requests, or stage further actions against the management interface.

text

# CHANGELOG entry referencing fixes in the 1.2.31 release window
1.2.31

-security#GHSA-6RVG-2VM8-5WRF: CVE-2026-22802 Authentication Bypass leads to information disclosure
-security: CVE-2026-1513 billboard.js before 3.18.0 Improper Input Sanitization Allows Remote JavaScript Execution
-security#GHSA-9wvp-cfx6-hj7p: CVE-2026-24482 1st argument to preg_replace is not sanitized and given from user_inputs
-security#GHSA-j3p9-q28q-8j33: CVE-2026-24483 Unsafe serialization usage in the maint plugin on user supplied POST data
-security#GHSA-23g4-vf2j-94w4: CVE-2026-39894 RRDtool metric shift via LC_NUMERIC locale comma decimal formatting

Source: GitHub Cacti Commit 891344a

Detection Methods for CVE-2026-39900

Indicators of Compromise

Requests to /auth_profile.php containing tab= values with JavaScript syntax such as quotes, angle brackets, semicolons, or keywords like alert, onerror, document.cookie, or fetch(.
Unusually long URL-encoded tab parameter values targeting authenticated administrator sessions.
Referrers to auth_profile.php originating from external domains or unexpected internal pages.

Detection Strategies

Inspect web server and reverse proxy logs for auth_profile.php requests where the tab parameter contains characters outside an expected allowlist of tab identifiers.
Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS payload patterns on Cacti endpoints.
Correlate XSS payload requests with subsequent authenticated API calls from the same session to identify follow-on activity.

Monitoring Recommendations

Track the installed Cacti version across assets and alert on hosts still running 1.2.30 or earlier.
Monitor outbound traffic from Cacti users' browsers to unknown domains immediately after visits to auth_profile.php.
Capture Content Security Policy (CSP) violation reports if CSP is enabled, focusing on inline script and external script load events.

How to Mitigate CVE-2026-39900

Immediate Actions Required

Upgrade Cacti to version 1.2.31 or later on all production and staging instances.
Invalidate active administrator sessions after upgrade to drop any sessions that may have been targeted.
Restrict access to the Cacti console to trusted networks or via VPN until patching is complete.

Patch Information

The issue is fixed in Cacti 1.2.31. Refer to the GitHub Security Advisory GHSA-34rf-frc3-v48r and the upstream fix in Cacti commit 891344a for technical details and the full set of security fixes shipped in 1.2.31.

Workarounds

Block or filter requests to auth_profile.php where the tab parameter does not match a strict allowlist of known tab names at the WAF or reverse proxy.
Enforce a strict Content Security Policy that disallows inline event handlers and untrusted script sources to reduce the impact of reflected payloads.
Train Cacti administrators to avoid clicking unsolicited links pointing to the Cacti console and to access the UI only from bookmarks or trusted sources.

bash

# Example NGINX rule to reject suspicious tab values pending patch deployment
location = /auth_profile.php {
    if ($arg_tab !~* "^(general|settings|user|graphs|logout)$") {
        return 400;
    }
    proxy_pass http://cacti_backend;
}