CVE-2026-39951: Cacti Stored SQL Injection Vulnerability

CVE-2026-39951 Overview

Cacti is an open source performance and fault management framework used by network administrators to graph time-series data from SNMP-enabled devices. CVE-2026-39951 is a stored SQL injection vulnerability [CWE-89] affecting Cacti versions 1.2.30 and prior. The flaw resides in the graph_name_regexp parameter within the Reports feature. Authenticated attackers with low privileges can inject malicious SQL statements that persist in the database and execute when the report is processed. The issue has been resolved in Cacti version 1.2.31.

Critical Impact
An authenticated attacker can inject arbitrary SQL through the Reports feature, leading to disclosure of sensitive database contents and potential modification of Cacti monitoring data.

Affected Products

Cacti versions 1.2.30 and prior
Cacti Reports feature (graph_name_regexp input)
Fixed in Cacti 1.2.31

Discovery Timeline

2026-06-25 - CVE-2026-39951 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-39951

Vulnerability Analysis

The vulnerability exists in the Cacti Reports feature, which allows users to schedule and generate graph reports based on filter criteria. The graph_name_regexp parameter accepts a regular expression intended to match graph names. Cacti incorporates this user-supplied input into a SQL query without sufficient sanitization or parameterization. Because the malicious payload is stored as part of a report configuration, the injection persists across sessions. When the report is later rendered or executed, the database engine evaluates the attacker-controlled SQL. This stored nature makes the vulnerability particularly effective in multi-user Cacti deployments where reports are shared.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The graph_name_regexp field is concatenated into a dynamic SQL statement rather than being bound through prepared statements. Cacti's defense-in-depth hardening in version 1.2.31 introduces additional input validation routines, including stricter rejection of dangerous metacharacters and broader use of CSV-safe and parameterized output helpers.

Attack Vector

Exploitation requires an authenticated Cacti user account with permission to create or modify reports. The attacker submits a crafted regular expression payload to the Reports configuration, which is stored in the database. When the report runs, the injected SQL executes in the database context used by Cacti. Successful exploitation can disclose credentials, modify monitoring data, or pivot toward additional attacks against the Cacti backend.

php

// Patch excerpt from automation_devices.php - CSV/SQL safe wrapping
	if ($item == '') {
		return 'N/A';
	} else {
-		return $item;
+		return cacti_csv_safe($item);
	}
}

// Patch excerpt from data_input.php - rejecting dangerous metacharacters
$save['input_string'] = form_input_validate(get_nfilter_request_var('input_string'), 'input_string', '', true, 3);
$save['type_id']      = form_input_validate(get_nfilter_request_var('type_id'), 'type_id', '^[0-9]+$', true, 3);

// Reject shell metacharacters outside of <placeholder> markers to prevent command injection
if (!is_error_message()) {
	$input_string_bare = preg_replace('/<([_a-zA-Z0-9]+)>/', '', $save['input_string']);

	if (preg_match('/[;&|`$\\\n\r]/', $input_string_bare)) {
		raise_message('validation_error', __('Input string contains dangerous shell characters'), MESSAGE_LEVEL_ERROR);
		header('Location: data_input.php?action=edit&id=' . (empty($save['id']) ? '' : $save['id']));
		exit;
	}
}

Source: Cacti commit 4c09efaebf3a9faec66969d0b5c4aceaf397f37f

Detection Methods for CVE-2026-39951

Indicators of Compromise

Unusual SQL syntax or quote characters stored in the graph_name_regexp field of Cacti report records.
Unexpected database errors logged by Cacti referencing the reports table or regex evaluation.
New or modified report entries created by low-privileged accounts shortly before anomalous database queries.

Detection Strategies

Audit the Cacti reports table for entries containing SQL keywords such as UNION, SELECT, --, or /* within regex fields.
Enable MySQL or MariaDB general query logging on the Cacti database and alert on queries originating from report rendering that include unexpected subqueries.
Review Cacti web server access logs for POST requests to report management endpoints containing suspicious payloads in graph_name_regexp.

Monitoring Recommendations

Monitor authentication and authorization logs for accounts creating or editing reports outside of normal change windows.
Track database account activity for the Cacti service user to detect privilege probing or schema enumeration.
Forward Cacti application and database logs to a centralized SIEM for correlation with web-tier activity.

How to Mitigate CVE-2026-39951

Immediate Actions Required

Upgrade Cacti to version 1.2.31 or later, which contains the consolidated defense-in-depth hardening for SQL injection paths.
Restrict access to the Reports feature to trusted administrative users until the upgrade is applied.
Rotate database credentials used by the Cacti application if exploitation is suspected.

Patch Information

The fix is included in Cacti 1.2.31 and is tracked in commit 4c09efaebf3a9faec66969d0b5c4aceaf397f37f. See the GitHub Security Advisory GHSA-pf37-v86f-5xwp for full details, and the upstream patch commit for the code-level changes.

Workarounds

Remove the Reports permission from non-administrator roles via Cacti's user management until patching is complete.
Place the Cacti web interface behind a web application firewall configured to inspect and block SQL injection patterns in report parameters.
Restrict the database account used by Cacti to the minimum privileges required, denying access to unrelated schemas.

bash

# Verify installed Cacti version and upgrade on a Debian/Ubuntu host
dpkg -l | grep -i cacti

# Backup the Cacti database before upgrade
mysqldump -u root -p cacti > cacti-backup-$(date +%F).sql

# Upgrade to the patched release (example using source tarball)
wget https://www.cacti.net/downloads/cacti-1.2.31.tar.gz
tar -xzf cacti-1.2.31.tar.gz
# Follow the official upgrade guide to replace the web root and run db_upgrade.php