CVE-2026-39955: Cacti Pre-Auth SQL Injection Vulnerability

CVE-2026-39955 Overview

Cacti is an open source performance and fault management framework used to monitor network devices and visualize time-series data. CVE-2026-39955 is a pre-authentication SQL injection vulnerability [CWE-89] in graph_view.php. The flaw stems from an unanchored FILTER_VALIDATE_REGEXP check that fails to constrain user-supplied input to the entire string. Attackers can craft requests that bypass validation and inject SQL into backend queries without authenticating. Versions 1.2.30 and prior are affected. The Cacti project released version 1.2.31 to remediate the issue.

Critical Impact
Unauthenticated remote attackers can inject SQL queries against the Cacti database, exposing credentials, monitoring data, and enabling further compromise of the host.

Affected Products

Cacti versions 1.2.30 and prior
Cacti graph_view.php component
Self-hosted Cacti monitoring deployments

Discovery Timeline

2026-06-24 - CVE-2026-39955 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-39955

Vulnerability Analysis

The vulnerability resides in graph_view.php, a script reachable before authentication in default Cacti deployments. The script validates request parameters using PHP's FILTER_VALIDATE_REGEXP filter, but the regular expression is not anchored with ^ and $. As a result, the filter accepts any input that contains a matching substring, allowing arbitrary characters before or after the legitimate pattern. Attackers can append SQL syntax to an otherwise valid value and the filter still returns success. The unsanitized value is then concatenated into a SQL statement, producing a classic SQL injection sink reachable without credentials.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. Unanchored regular expressions are a recurring source of input validation failures in PHP applications. FILTER_VALIDATE_REGEXP returns the original value when any substring matches, not when the entire input matches. Developers expecting full-string validation must explicitly anchor patterns. Cacti's fix in 1.2.31 consolidates defense-in-depth hardening, anchoring validators and adding additional input filtering across multiple administrative components.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to graph_view.php with malicious payloads in parameters that flow into SQL queries. Successful exploitation can disclose database contents including hashed user credentials, modify monitoring configurations, or be chained with other Cacti weaknesses to achieve code execution on the underlying host.

php

// Patch excerpt: defense-in-depth hardening in data_input.php
$save['input_string'] = form_input_validate(get_nfilter_request_var('input_string'), 'input_string', '', true, 3);
$save['type_id']      = form_input_validate(get_nfilter_request_var('type_id'), 'type_id', '^[0-9]+$', true, 3);

// Reject shell metacharacters outside of <placeholder> markers to prevent command injection
if (!is_error_message()) {
    $input_string_bare = preg_replace('/<([_a-zA-Z0-9]+)>/', '', $save['input_string']);

    if (preg_match('/[;&|`$\\\n\r]/', $input_string_bare)) {
        raise_message('validation_error', __('Input string contains dangerous shell characters'), MESSAGE_LEVEL_ERROR);
        header('Location: data_input.php?action=edit&id=' . (empty($save['id']) ? '' : $save['id']));
        exit;
    }
}

Source: Cacti commit 4c09efae

Detection Methods for CVE-2026-39955

Indicators of Compromise

Unauthenticated HTTP requests to graph_view.php containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA.
Web server access logs showing long or URL-encoded parameter values targeting graph_view.php from unfamiliar source addresses.
Database error messages or anomalous query latency originating from the Cacti web user.
New or modified rows in the user_auth table not aligned with administrator activity.

Detection Strategies

Deploy web application firewall rules that block common SQL injection signatures targeting Cacti endpoints.
Enable MySQL or MariaDB general query logging temporarily to identify suspicious query patterns issued by the Cacti service account.
Compare installed Cacti version against 1.2.31 across all hosts and flag any older instance as vulnerable.

Monitoring Recommendations

Forward Cacti web server, PHP-FPM, and database logs to a centralized analytics platform for correlation.
Alert on bursts of 4xx and 5xx responses from graph_view.php that may indicate injection probing.
Monitor outbound network connections from the Cacti host for unexpected destinations following suspicious requests.

How to Mitigate CVE-2026-39955

Immediate Actions Required

Upgrade Cacti to version 1.2.31 or later on all production and staging instances.
Restrict network access to the Cacti web interface to trusted management subnets until the patch is applied.
Rotate database credentials and any administrator passwords stored in Cacti after patching.
Review the user_auth table and audit logs for unauthorized changes that may predate the upgrade.

Patch Information

The Cacti project addressed the issue in version 1.2.31. The fix is part of a consolidated defense-in-depth commit that anchors regular expression validators and adds rejection of dangerous metacharacters. Details are available in the Cacti GitHub Security Advisory GHSA-gp82-qhrg-crv7 and the corresponding upstream commit.

Workarounds

Place the Cacti web interface behind an authenticating reverse proxy or VPN until patching is complete.
Apply WAF rules that block SQL metacharacters in query parameters submitted to graph_view.php.
Disable public exposure of the Cacti server and restrict access through firewall ACLs to known operator hosts.

bash

# Example: restrict Cacti access at the web server level (Apache)
<Location "/cacti/graph_view.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>

# Verify installed Cacti version after upgrade
grep "cacti_version" /var/www/html/cacti/include/cacti_version