CVE-2026-40080: 
Cacti vulnerability analysis and mitigation

CVE-2026-40080 is an Open Redirect vulnerability in Cacti, an open-source performance and fault management framework, caused by an insufficient substring-based validation of the HTTP Referer header in the auth_login_redirect() function. All versions up to and including 1.2.30 are affected; the issue was fixed in version 1.2.31. The vulnerability was discovered internally by the Cacti security team and published on June 25, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-601: URL Redirection to Untrusted Site) lies in lib/auth.php within the auth_login_redirect() function. When a user's login_opts is set to 1 (redirect to referrer after login), the function validates the $_SERVER['HTTP_REFERER'] value using str_contains($referer, CACTI_PATH_URL) — a substring check rather than a proper host/origin check. An attacker can craft a Referer header such as https://evil.com/cacti/ where CACTI_PATH_URL is /cacti/; the substring /cacti/ matches within the attacker-controlled URL, causing the user to be redirected to evil.com after a successful login. A pre-existing helper function validate_redirect_url() in lib/html_utility.php (lines 1447–1507) performs proper host-based validation but was never called from auth_login_redirect(). The fix, merged in PR #7054 (commit 891344a5), replaces the substring check with a call to validate_redirect_url(), which rejects external hostnames, javascript:, data:, protocol-relative URLs, and path traversal sequences (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to redirect a victim user to an arbitrary external website immediately after they log into Cacti, enabling phishing attacks, credential harvesting, or malware delivery. The confidentiality and integrity impacts are rated low — the attacker does not gain direct access to Cacti data or system resources, but can deceive users into trusting a malicious site that mimics Cacti or another trusted service. Availability is not impacted (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify a Cacti instance running version 1.2.30 or earlier that is accessible to the target user, and confirm the installation path (e.g., /cacti/) to determine the value of CACTI_PATH_URL.
2. Confirm login_opts setting: The attack is most effective when the target user has login_opts set to 1 (redirect to referrer after login), which may be the default or configurable per user.
3. Craft malicious URL: Construct a URL or link that causes the victim's browser to send a Referer header containing the attacker's domain with the Cacti path as a suffix, e.g., https://evil.com/cacti/index.php.
4. Deliver the lure: Trick the target user into navigating to the Cacti login page from the attacker-controlled page (e.g., via a phishing email or malicious link), so the browser automatically sets Referer: https://evil.com/cacti/index.php.
5. User logs in: The victim authenticates normally to Cacti.
6. Redirect occurs: auth_login_redirect() evaluates str_contains('https://evil.com/cacti/index.php', '/cacti/') as true and issues a Location: redirect to https://evil.com/cacti/index.php, sending the user to the attacker's site (GitHub Advisory).

• Network: HTTP requests to the Cacti login page (/cacti/index.php or equivalent) where the Referer header contains an external domain followed by the Cacti installation path (e.g., Referer: https://evil.com/cacti/).
• Logs: Web server access logs showing a 302 redirect response from the Cacti login endpoint to an external domain immediately following a successful authentication event.
• Logs: Cacti application logs recording login events where the post-login redirect destination is an external hostname rather than the local Cacti instance.

The primary remediation is to upgrade Cacti to version 1.2.31 or later, which replaces the flawed substring check with a call to validate_redirect_url() that properly validates the host of the referrer URL (GitHub Advisory, Cacti Release). As a temporary workaround for deployments that cannot immediately upgrade, administrators can set users' login_opts to a value other than 1 (disabling the redirect-to-referrer behavior), which prevents the vulnerable code path from being triggered. Additionally, deploying a web application firewall (WAF) rule to block or sanitize Referer headers containing external hostnames on the Cacti login endpoint can reduce exposure.

The vulnerability was identified through an internal audit by the Cacti security team and responsibly disclosed via GitHub's security advisory process. The Cacti 1.2.31 release notes acknowledge the broader security effort and thank the community for responsible disclosure, noting that security remains a fundamental project priority (Cacti Release). No significant independent researcher commentary or notable social media discussion has been identified for this specific CVE.