CVE Intelligence
Analysis AI-assisted

CVE-2026-39893: Cacti SQL Injection via rfilter Parameter

Cacti versions 1.2.30 and prior pass the rfilter request variable into an RLIKE SQL clause without sanitization, which is a SQL injection weakness (CWE-89). The record states it is reachable without authentication on installations where guest graph viewing is enabled, and it is rated critical with a CVSS 3.1 base score of 9.8. The issue is fixed in version 1.2.31.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Cacti is an open source performance and fault management framework. According to the record, versions 1.2.30 and prior pass the rfilter request variable into an RLIKE SQL clause without sanitization, a SQL injection weakness classified as CWE-89. The fix is available in version 1.2.31, and the linked pull request is the patch reference.

Impact

  • The record describes the flaw as reachable without authentication when guest graph viewing is enabled through the configured guest user.
  • The CVSS 3.1 base score is 9.8 (critical), with a vector indicating network access, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • The specific data that could be read or altered through this flaw is not detailed in the available record.

Affected products and versions

  • Product listed: Cacti Cacti.
  • Affected range in the record: versions before 1.2.31, with the description naming 1.2.30 and prior.
  • Fixed version: 1.2.31.

Exploitation status

The record shows this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation in the wild appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

  • Upgrade Cacti to version 1.2.31 or later, using the upstream security advisory as the primary reference.
  • Review the patch pull request to understand the scope of the change.
  • If an immediate upgrade is not possible, consider disabling guest access to graph viewing and reviewing the guest user configuration, since the record ties pre-authentication reachability to that setting.
  • Limit access to the Cacti web interface to trusted networks where feasible.

Detection guidance

  • Review web server and application logs for unusual requests to Cacti that contain unexpected characters or database error messages, particularly from unauthenticated sessions.
  • Check whether guest viewing is enabled and whether the guest account is in active use.
  • Monitor database logs for SQL syntax errors originating from the Cacti application.

Limitations of the available information

  • The record does not identify the exact affected endpoint, the database backend in use, or the data exposed.
  • No proof-of-concept code or exploitation telemetry is mentioned in the sources consulted.
  • Additional detail should be verified against the upstream advisory.

Frequently asked questions

Does this Cacti flaw require authentication to be reached?

According to the record, the endpoint does not require authentication, but the issue is reachable pre-authentication only on installations where guest graph viewing is enabled through the configured guest user.

Which version fixes CVE-2026-39893?

The record states the issue was fixed in Cacti version 1.2.31, and it lists versions before 1.2.31 as affected.

Is this vulnerability known to be exploited in the wild?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.