CVE-2026-39955: Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php

Synopsis

This is a pre-authentication SQL injection vulnerability in Cacti, an open source performance and fault management framework, affecting versions 1.2.30 and earlier. The flaw is reachable over the network and requires no login, because the regular expression used to validate input in graph_view.php is unanchored, allowing attackers to smuggle SQL syntax through the validation check. Successful exploitation gives an attacker full read, write, and delete access to the underlying database, and may enable remote code execution depending on database permissions. HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint in graph_view.php is exposed over the network, so an attacker must be able to reach the Cacti service via HTTP/HTTPS from any network location.

• AuthenticationNot required

  Exploitation requires no account or session cookie; the injection point is reachable before any login step.

• Victim interactionNot required

  No user action is needed; the attacker sends a crafted request directly to the server without involving any logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and repeatable with no dependency on race conditions, memory layout, or other variable environmental factors.

Blast Radius

• An attacker can read all data stored in the Cacti database, including device credentials, poller configurations, and any other persisted records.
• An attacker can insert, modify, or delete database rows, corrupting monitoring data or altering device configuration stored in Cacti.
• Depending on the database user's filesystem privileges (for example, FILE privilege in MySQL), an attacker may be able to write arbitrary files to the server, enabling remote code execution.
• The Cacti service itself may be disrupted if an attacker drops tables or corrupts critical configuration data.