CVE Intelligence
Analysis AI-assisted

CVE-2026-39948: Cacti - Pre-authentication SQL Injection via rfilter Parameter

Cacti versions 1.2.30 and earlier contain an SQL injection flaw (CWE-89) in the rfilter parameter handled by graph_view.php. When guest graph viewing is enabled, the flaw can be reached without authentication. The issue is fixed in version 1.2.31.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Cacti is an open source performance and fault management framework. CVE-2026-39948 is an SQL injection flaw (CWE-89) in how the rfilter request parameter is handled through graph_view.php. According to the record, the value is read with a raw accessor and placed into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php without the regex validation intended for it.

Impact

  • The record states that an attacker could compromise the confidentiality, integrity and availability of the underlying database.
  • NVD assigns a score of 9.8 under CVSS 3.1. GitHub assigns 9.3 under CVSS 4.0.
  • The record states the issue is reachable without authentication on installations where guest graph viewing is enabled.

Affected products and versions

  • Cacti (product listed as Cacti Cacti): versions before 1.2.31 according to the record.
  • The description states that versions 1.2.30 and prior are affected.
  • The description states the issue is fixed in version 1.2.31.

Exploitation status

The CISA KEV catalogue entry in the record is not listed. No confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

  • Upgrade Cacti to version 1.2.31 or later.
  • Until the upgrade is applied, disable guest graph viewing if it is not required.
  • Limit network exposure of the Cacti web interface to trusted users and networks.
  • Review the GitHub security advisory and the fix commit.

Detection guidance

  • Review web server logs for requests to graph_view.php that carry unusually formed or unexpected rfilter values.
  • Watch application and database logs for SQL syntax errors that originate from graph requests.
  • Treat unexpected database errors from the Cacti web interface as a signal for further investigation.

Limitations of the available information

  • The record does not describe the full exploitation conditions beyond the guest graph viewing setting.
  • The record does not say whether fixes were backported to other release branches.
  • No exploitation telemetry, EPSS score or SSVC data is present in the record.
  • The default state of guest graph viewing is not stated in the record.

Frequently asked questions

Which Cacti versions are affected by CVE-2026-39948?

According to the record, Cacti versions 1.2.30 and prior are affected, and the issue is fixed in version 1.2.31.

Does this issue require authentication to exploit?

The record states the flaw is reachable through graph_view.php without authentication on installations where guest graph viewing is enabled.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in the CISA KEV catalogue, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.