CVE-2026-39893: Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php

Synopsis

Pre-authentication SQL injection in Cacti affects versions 1.2.30 and prior via the rfilter request variable in graph_view.php. The endpoint is reachable over the network without any credentials because Cacti supports guest access for graph viewing, meaning an attacker only needs HTTP access to the server. Successful exploitation gives the attacker full read, write, and delete access to the underlying database. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is served over HTTP/HTTPS, so the attacker must be able to reach the Cacti server across the network.

• AuthenticationNot required

  The graph_view.php endpoint supports unauthenticated guest access, so no credentials of any kind are needed to trigger the injection.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific conditions to succeed.

Blast Radius

• Reads any data stored in the Cacti database, including device credentials, user password hashes, and poller configuration.
• Modifies or deletes persisted database rows, allowing an attacker to alter monitoring targets, user accounts, or configuration records.
• Depending on database user privileges, writes to the filesystem via SQL outfile operations, potentially enabling remote code execution.
• Disrupts the monitoring service by truncating or corrupting critical tables, causing Cacti to stop collecting or displaying performance data.