CVE-2026-40941: 
Cacti vulnerability analysis and mitigation

CVE-2026-40941 is a package import signature validation bypass vulnerability in Cacti, an open-source performance and fault management framework. The flaw allows authenticated users with package import privileges to import self-signed packages without proper cryptographic verification, bypassing intended security controls on package authenticity. All versions up to and including 1.2.30 are affected; the issue was fixed in version 1.2.31, released on June 15, 2026. The vulnerability was publicly disclosed on June 25, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature): Cacti's package import functionality failed to properly validate the cryptographic signature of imported packages, permitting self-signed packages to be accepted as legitimate. The fix, implemented in PR #7054, removed the legacy SHA-1 key verification path and enforced SHA-256 for all package signature verification, meaning packages signed with the old key must be re-signed to be importable. Exploitation requires network access and low-level authenticated privileges (e.g., an account with package import rights), but no user interaction is needed. The attack vector is network-based with low attack complexity (GitHub Advisory, GitHub PR #7054).

Successful exploitation allows an authenticated attacker with package import privileges to introduce malicious self-signed packages into the Cacti framework, potentially enabling arbitrary code execution or persistent compromise of the Cacti installation. The primary impact is on integrity (rated High), as there is no direct confidentiality or availability impact from the bypass itself. However, a malicious package could serve as a foothold for further lateral movement, data exfiltration, or full system compromise depending on the content of the imported package (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a Cacti instance running version 1.2.30 or earlier. Confirm the target version via the Cacti web UI login page or HTTP response headers.
2. Obtain Authenticated Access: Acquire credentials for an account with package import privileges (e.g., an administrator account or a user with delegated import rights).
3. Craft a Malicious Self-Signed Package: Create a Cacti-compatible package archive containing a malicious payload (e.g., a PHP web shell or a data input method with injected shell commands). Sign the package with a self-generated (self-signed) key rather than the official Cacti signing key.
4. Import the Package: Navigate to the Cacti package import interface (typically under Import/Export in the admin panel) and upload the crafted self-signed package. Due to the signature validation bypass, the package is accepted without proper verification.
5. Achieve Code Execution: Once the malicious package is imported, trigger the embedded payload (e.g., access the installed web shell or invoke the malicious data input method) to execute arbitrary commands on the server (GitHub Advisory, GitHub PR #7054).

• Logs: Cacti application logs showing package import events from unexpected or unauthorized user accounts; import of packages with unrecognized or self-generated signing keys.
• File System: Unexpected PHP files or scripts appearing in the Cacti scripts/ or resource/ directories following a package import operation; presence of web shells or unfamiliar PHP files in the Cacti web root.
• Network: Outbound connections from the Cacti server to unknown external hosts shortly after a package import event, potentially indicating reverse shell or C2 activity.
• Process: Unusual child processes spawned by the Cacti web server process (e.g., bash, curl, wget, python) following a package import.
• Database: New or modified data input methods in the Cacti database (data_input table) containing shell metacharacters or unexpected command strings (GitHub PR #7054).

Upgrade Cacti to version 1.2.31 or later, which enforces SHA-256 for all package signature verification and removes the legacy SHA-1 bypass path (GitHub Release, GitHub Advisory). No official workaround short of upgrading has been published; however, as an interim measure, administrators should restrict package import functionality to the minimum number of trusted accounts and audit existing imported packages for unexpected content. Organizations should also review user accounts with import privileges and ensure that only verified, officially signed packages are imported.

The vulnerability was responsibly disclosed by researcher davidkm-ai and coordinated by netniV (Cacti maintainer), with remediation review credited to TheWitness. The Cacti project acknowledged the issue in their 1.2.31 release notes, emphasizing their ongoing commitment to security and responsible disclosure (GitHub Release). Red Hat tracked the issue via Bugzilla (Bug 2493265) and assigned it high severity (Red Hat Bugzilla). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.