Cacti up to 1.2.30 Automation Tree Rule Item lib/api_automation.php create_all_header_nodes sql injection

Summaryinfo

A vulnerability described as problematic has been identified in Cacti up to 1.2.30. Affected by this issue is the function create_all_header_nodes of the file lib/api_automation.php of the component Automation Tree Rule Item Handler. The manipulation results in sql injection. This vulnerability is identified as CVE-2026-46531. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Cacti up to 1.2.30. It has been classified as problematic. Affected is the function create_all_header_nodes of the file lib/api_automation.php of the component Automation Tree Rule Item Handler. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 ("Apply Automation Rules") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-46531 since 05/14/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation needs additional levels of successful authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

By approaching the search of inurl:lib/api_automation.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.2.31 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Log Management Software

Name

• Cacti

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13
• 1.2.14
• 1.2.15
• 1.2.16
• 1.2.17
• 1.2.18
• 1.2.19
• 1.2.20
• 1.2.21
• 1.2.22
• 1.2.23
• 1.2.24
• 1.2.25
• 1.2.26
• 1.2.27
• 1.2.28
• 1.2.29
• 1.2.30

License

• open-source

Website

• Product: https://github.com/Cacti/cacti/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion