{"id":"CVE-2026-46531","kind":"vulnerability","aliases":["CVE-2026-46531"],"related":[],"title":"Cacti: stored SQL injection through automation tree rules, fixed in 1.2.31","description":"Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 (\"Apply Automation Rules\") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31.","summary":"Cacti versions 1.2.27 up to 1.2.31 let a user with the Automation permission store a SQL fragment in an automation tree rule that is later run unsanitized against the database. The injected query output is written into the Cacti tree UI, which gives the attacker a way to read data from the database.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cacti","monitoring","package","self-hosted"],"not_affected_if":["automation-realm-restricted","version-1.2.31-or-later","version-below-1.2.27"],"how_to_check":"- Check the installed Cacti version in the web UI footer or in `include/global.php` (look for `$config['cacti_version']`).\n- In the Cacti UI, review Automation tree rules for unexpected entries if you suspect misuse.","fix":"- Upgrade Cacti to `1.2.31` or later.\n- Until upgraded, restrict the Automation realm to trusted users only.","status":"open","published_at":"2026-10-23T15:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:10:39+00:00","updated_at":"2026-10-25T04:10:39+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:10:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cacti to `1.2.31` or later.\n- Until upgraded, restrict the Automation realm to trusted users only.","reach":"network","title":"Cacti: stored SQL injection through automation tree rules, fixed in 1.2.31","impact":"medium","summary":"Cacti versions 1.2.27 up to 1.2.31 let a user with the Automation permission store a SQL fragment in an automation tree rule that is later run unsanitized against the database. The injected query output is written into the Cacti tree UI, which gives the attacker a way to read data from the database.","category":"package","nicknames":[],"who_cares":["cacti","self-hosted","monitoring"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker reads database contents through the tree UI output","analyst_note":"","how_to_check":"- Check the installed Cacti version in the web UI footer or in `include/global.php` (look for `$config['cacti_version']`).\n- In the Cacti UI, review Automation tree rules for unexpected entries if you suspect misuse.","needs_analyst":false,"not_affected_if":["version-below-1.2.27","version-1.2.31-or-later","automation-realm-restricted"],"who_is_affected":"Cacti installations running versions from 1.2.27 up to but not including 1.2.31 are affected. The attacker needs an account with the Automation realm, which the default General Administration role includes, and the exploit fires when an administrator applies automation rules. Installations on earlier or patched releases can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3484,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-46531':14A,17A '1.2.27':26B,89C '1.2.31':11A,29B,93C,200C '8':165C 'action':161C,162C,164C,170C 'administr':119C,154C 'appli':166C 'arbitrari':124C 'attack':68B 'authent':97C 'autom':6A,35B,43B,106C,115C,156C,167C 'automation_tree_rule_items.field':129C 'bulk':169C 'cacti':1A,18B,24B,62B,77C,94C,185C 'chann':192C 'claus':143C 'column':130C 'concaten':135C 'contain':95C 'creat':146C 'cve':12A,15A 'data':73B 'databas':53B,76B 'default':117C 'direct':136C,190C 'drp':163C 'execut':151C 'exfiltr':191C 'fault':84C 'fix':9A 'fragment':40B,126C,132C 'framework':86C 'general':118C 'give':66B 'graph_tree_items.title':180C 'graphs.php':160C 'handler':110C 'header':148C 'hold':113C 'host':23B 'inject':4A,55B,103C,175C 'issu':194C 'item':109C 'later':48B,134C 'let':30B 'lib/api_automation.php':145C 'manag':85C 'monitor':19B 'node':149C 'open':80C 'order':101C 'output':57B 'packag':20B 'patch':197C 'perform':82C 'permiss':36B 'persist':122C 'provid':188C 'queri':56B 'read':72B 'realm':116C 'render':182C 'result':172C 'role':120C 'rule':8A,45B,108C,168C 'run':49B 'second':100C 'second-ord':99C 'select':139C,176C 'self':22B 'self-host':21B 'sourc':81C,141C 'sql':3A,39B,102C,125C 'standard':159C 'store':2A,37B,98C 'tree':7A,44B,63B,107C,186C 'trigger':155C 'ui':64B,187C 'unsanit':50B 'user':32B,112C 'version':25B,88C,92C,199C 'via':157C 'way':70B 'written':59B,178C","nicknames":[],"mitigations":[],"who_affected":"Cacti installations running versions from 1.2.27 up to but not including 1.2.31 are affected. The attacker needs an account with the Automation realm, which the default General Administration role includes, and the exploit fires when an administrator applies automation rules. Installations on earlier or patched releases can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-46531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46531","severity":null,"published_at":"2026-10-23T15:17:31+00:00","modified_at":"2026-10-23T19:36:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}