Cacti up to 1.2.30 rrdtool_function_update function with inconsistent implementations

Summaryinfo

A vulnerability was found in Cacti up to 1.2.30. It has been declared as problematic. This affects the function rrdtool_function_update. Executing a manipulation can lead to use of function with inconsistent implementations. This vulnerability is registered as CVE-2026-39894. The attack needs to be launched locally. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Cacti up to 1.2.30 and classified as problematic. This vulnerability affects the function rrdtool_function_update. The manipulation with an unknown input leads to a use of function with inconsistent implementations vulnerability. The CWE definition for the vulnerability is CWE-474. The code uses a function that has inconsistent implementations across operating systems and versions. As an impact it is known to affect integrity. CVE summarizes:

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. The rrdtool_function_update() function checks metric values with is_numeric() and concatenates them into the RRDtool update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LC_NUMERIC uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-39894 since 04/07/2026. The exploitation appears to be difficult. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 1.2.31 eliminates this vulnerability. Applying the patch d2a698854956e9e4e53da9eab5b5719ae40e6893 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Log Management Software

Name

• Cacti

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13
• 1.2.14
• 1.2.15
• 1.2.16
• 1.2.17
• 1.2.18
• 1.2.19
• 1.2.20
• 1.2.21
• 1.2.22
• 1.2.23
• 1.2.24
• 1.2.25
• 1.2.26
• 1.2.27
• 1.2.28
• 1.2.29
• 1.2.30

License

• open-source

Website

• Product: https://github.com/Cacti/cacti/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion