Live › vulnerability › CVE-2026-49442
Go to dashboardCacti's login page returns a slightly different error for existing and non-existing usernames, differing only in the capitalization of "failed". An attacker can use this to confirm valid usernames before attempting password guesses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Cacti installation running a version before 1.2.31 is exposed, if its login page can be reached by the attacker. Installations that are only reachable on a trusted internal network carry less risk. The sources do not describe any extra configuration needed to trigger it.
No product ranges from the sources yet.
include/global.php in the install directory.1.2.31 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on whether the provided username exists in the system. When username exists on Cacti, in the response, they see Access Denied! Login failed. When it does not exist on Cacti, they see Access Denied! Login Failed. The only difference between the responses is the capitalization of the letter "f" in the word failed. This issue has been patched in version 1.2.31.
This page as .md · .json · in your agent: get_signal("CVE-2026-49442")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.