Live › vulnerability › CVE-2026-46531
Go to dashboardCacti versions 1.2.27 up to 1.2.31 let a user with the Automation permission store a SQL fragment in an automation tree rule that is later run unsanitized against the database. The injected query output is written into the Cacti tree UI, which gives the attacker a way to read data from the database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Cacti installations running versions from 1.2.27 up to but not including 1.2.31 are affected. The attacker needs an account with the Automation realm, which the default General Administration role includes, and the exploit fires when an administrator applies automation rules. Installations on earlier or patched releases can skip it.
No product ranges from the sources yet.
include/global.php (look for $config['cacti_version']).1.2.31 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 ("Apply Automation Rules") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31.
This page as .md · .json · in your agent: get_signal("CVE-2026-46531")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.