CVE-2026-39948: Cacti has SQL Injection via rfilter parameter in RLIKE clauses

Synopsis

SQL injection via the rfilter request parameter affects Cacti versions 1.2.30 and earlier. The vulnerability is reachable over the network with no authentication required on installations where guest graph viewing is enabled, because the affected code path in graph_view.php is exposed pre-authentication. Successful exploitation gives an attacker the ability to read and modify arbitrary database contents. A patched-image rebuild at version 1.2.31 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint (graph_view.php) is exposed over the network, so the attacker must be able to reach the Cacti web service via HTTP/HTTPS.

• AuthenticationNot required

  The injection path is reachable pre-authentication on any Cacti installation where guest graph viewing is enabled; no account or session token is needed.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly to the server; no user action or social engineering is required.

• Attack complexityDetail

  Attack complexity is low: the exploit is a straightforward unbalanced-quote payload that requires no race conditions, timing windows, or environment-specific conditions to succeed.

Blast Radius

• Reads arbitrary rows from the Cacti database, including stored credentials, user session data, and device performance records.
• Modifies persisted database rows, allowing an attacker to alter thresholds, device configurations, or user account data.
• Because guest graph viewing can be enabled on public-facing installations, exploitation is reachable without any prior foothold on the host or network.
• Database integrity loss can corrupt monitoring data, causing false alerts or masking genuine infrastructure faults.