CVE-2026-40079: Cacti Command Injection RCE Vulnerability

CVE-2026-40079 Overview

CVE-2026-40079 is a Command Injection vulnerability [CWE-78] in Cacti, an open source performance and fault management framework. Versions 1.2.30 and earlier ship an escape_command() function in lib/rrd.php that operates as a no-op and returns the $command string unchanged. The unsanitized command line built by rrdtool_function_graph() is then passed directly to shell_exec($full_commandline) inside __rrd_execute(). Attackers who can influence text_format values from graph templates, including host variable substitutions, can inject shell metacharacters that the host will execute. The issue is fixed in Cacti version 1.2.31.

Critical Impact
Authenticated attackers with privileges over graph templates can achieve arbitrary command execution on the Cacti host by injecting shell metacharacters into text_format values that reach shell_exec unsanitized.

Affected Products

Cacti versions 1.2.30 and prior
Cacti lib/rrd.phpescape_command() function
Cacti rrdtool_function_graph() / __rrd_execute() execution path

Discovery Timeline

2026-06-25 - CVE-2026-40079 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-40079

Vulnerability Analysis

The defect is an OS Command Injection [CWE-78] in the rrdtool integration layer of Cacti. The escape_command() helper in lib/rrd.php is intended to neutralize shell metacharacters in command lines passed to rrdtool. In versions 1.2.30 and prior, the function simply returns its input parameter $command without modification. The graph rendering path in rrdtool_function_graph() assembles a full command line that incorporates text_format values from graph templates. These values may include host variable substitutions controlled by graph and device configuration. The assembled string is routed through the inert escape_command() and then executed with shell_exec($full_commandline) in __rrd_execute(). Any unescaped shell metacharacter such as ;, |, &, backticks, or $() injected through text_format is interpreted by the shell, resulting in arbitrary command execution under the Cacti service account.

Root Cause

The root cause is missing input sanitization in a security-critical helper. escape_command() exists as a sanitization boundary but performs no escaping, leaving shell_exec() exposed to user-influenced template data. The combination of a no-op sanitizer and direct shell invocation defeats any assumption of safety in calling code.

Attack Vector

Exploitation requires network access to the Cacti instance and high privileges sufficient to modify graph templates or related host variables that feed text_format. An authenticated attacker stores a payload containing shell metacharacters in a template field. When the graph is rendered, the payload is concatenated into the rrdtool command line and executed by the underlying shell.

php

// Patch excerpt from automation_devices.php
 	if ($item == '') {
 		return 'N/A';
 	} else {
-		return $item;
+		return cacti_csv_safe($item);
 	}
 }

// Patch excerpt from data_input.php
+		// Reject shell metacharacters outside of <placeholder> markers to prevent command injection
+		if (!is_error_message()) {
+			$input_string_bare = preg_replace('/<([_a-zA-Z0-9]+)>/', '', $save['input_string']);
+
+			if (preg_match('/[;&|`$\\\\\n\r]/', $input_string_bare)) {
+				raise_message('validation_error', __('Input string contains dangerous shell characters'), MESSAGE_LEVEL_ERROR);
+				header('Location: data_input.php?action=edit&id=' . (empty($save['id']) ? '' : $save['id']));
+				exit;
+			}
+		}

Source: Cacti commit 4c09efaebf3a9faec66969d0b5c4aceaf397f37f. The patch introduces input filtering that rejects shell metacharacters outside placeholder markers and applies cacti_csv_safe() to outbound values, establishing the defense-in-depth that the no-op escape_command() failed to provide.

Detection Methods for CVE-2026-40079

Indicators of Compromise

Unexpected child processes of the Cacti PHP or web server account spawned during graph rendering, especially shells such as sh, bash, cmd.exe, or interpreters like python and perl.
Graph template or data input text_format and input_string fields containing shell metacharacters such as ;, |, &, backticks, or $(...).
Outbound network connections initiated by the Cacti host immediately following graph rendering or polling cycles.
Modifications to lib/rrd.php or surrounding rrdtool helper files that do not match the upstream 1.2.31 release.

Detection Strategies

Hunt for shell_exec invocations in web server process trees with command lines containing rrdtool plus shell control characters.
Review the Cacti audit and web access logs for POST requests to graph_templates.php, data_input.php, and host.php that contain metacharacters in template fields.
Compare deployed Cacti PHP files against the 1.2.31 reference to identify tampered installations.

Monitoring Recommendations

Enable verbose process auditing on the Cacti host so child processes of PHP-FPM or Apache are recorded with full command lines.
Alert on graph template and data input modifications by accounts that do not normally perform administrative changes.
Monitor egress traffic from the Cacti server and treat unexpected outbound connections from the web service account as high priority.

How to Mitigate CVE-2026-40079

Immediate Actions Required

Upgrade Cacti to version 1.2.31 or later on all instances, including air-gapped and test environments.
Restrict accounts with permission to edit graph templates, data inputs, and host variables to a minimum trusted set.
Audit existing graph templates and data input definitions for shell metacharacters in text_format and input_string fields and remove suspicious entries.
Rotate credentials and SNMP community strings on the Cacti host if any tampering is suspected.

Patch Information

The maintainers fixed the issue in Cacti 1.2.31 through the consolidated defense-in-depth hardening pull request tracked in commit 4c09efaebf3a9faec66969d0b5c4aceaf397f37f. The fix introduces validation that rejects dangerous shell characters in input strings outside placeholder markers and applies cacti_csv_safe() to values returned from automation paths. See the Cacti GitHub Security Advisory GHSA-xq98-376r-hv9j for the full advisory.

Workarounds

If immediate upgrade is not feasible, revoke template and data input editing privileges from all non-essential administrative accounts.
Place the Cacti web interface behind a reverse proxy or VPN and restrict access by source IP to known operators.
Run the Cacti PHP worker under a dedicated low-privilege user with noexec and restrictive AppArmor or SELinux policies to limit the blast radius of a successful injection.

bash

# Configuration example: upgrade Cacti and harden the service account
sudo systemctl stop apache2
cd /var/www/html/cacti
sudo -u www-data git fetch --tags
sudo -u www-data git checkout release/1.2.31
sudo -u www-data php cli/upgrade_database.php
# Restrict shell access for the web service account
sudo usermod -s /usr/sbin/nologin www-data
sudo systemctl start apache2