CVE-2026-46531

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46531", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-14T19:12:32.756Z", "datePublished": "2026-10-23T14:42:27.937Z", "dateUpdated": "2026-10-29T17:56:17.459Z"}, "containers": {"cna": {"title": "Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2"}, {"name": "https://github.com/Cacti/cacti/pull/7163", "tags": ["x_refsource_MISC"], "url": "https://github.com/Cacti/cacti/pull/7163"}], "affected": [{"vendor": "Cacti", "product": "cacti", "versions": [{"version": ">= 1.2.27, < 1.2.31", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-23T14:42:27.937Z"}, "descriptions": [{"lang": "en", "value": "Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 (\"Apply Automation Rules\") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31."}], "source": {"advisory": "GHSA-37jj-rx8x-4wf2", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T17:55:52.670346Z", "id": "CVE-2026-46531", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T17:56:17.459Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46531", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T17:55:52.670346Z"}}}], "references": [{"url": "https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T17:56:11.166Z"}}], "cna": {"title": "Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)", "source": {"advisory": "GHSA-37jj-rx8x-4wf2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cacti", "product": "cacti", "versions": [{"status": "affected", "version": ">= 1.2.27, < 1.2.31"}]}], "references": [{"url": "https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2", "name": "https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Cacti/cacti/pull/7163", "name": "https://github.com/Cacti/cacti/pull/7163", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 (\"Apply Automation Rules\") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-23T14:42:27.937Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46531", "state": "PUBLISHED", "dateUpdated": "2026-10-29T17:56:17.459Z", "dateReserved": "2026-05-14T19:12:32.756Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-23T14:42:27.937Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cacti", "vendor": "Cacti", "versions": [{"status": "affected", "version": ">= 1.2.27, < 1.2.31"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 (\"Apply Automation Rules\") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31."}], "id": "CVE-2026-46531", "lastModified": "2026-10-29T18:17:31.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46531", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T17:55:52.670346Z", "version": "2.0.3"}}]}, "published": "2026-10-23T15:17:31.317", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Cacti/cacti/pull/7163"}, {"source": "security-advisories@github.com", "url": "https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "cacti: cacti: information disclosure via SQL injection in automation tree rules", "id": "2559922", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559922"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-89", "details": ["Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 (\"Apply Automation Rules\") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31.", "A flaw was found in Cacti. An authenticated attacker with automation administration privileges can trigger information disclosure by injecting malicious Structured Query Language (SQL) commands into the automation tree rule item handler. Because these commands are stored and later concatenated directly into database queries during rule processing, they are executed and their results are displayed in the user interface. This issue allows the attacker to extract sensitive records from the underlying database."], "name": "CVE-2026-46531", "public_date": "2026-10-23T14:42:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46531\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46531\nhttps://github.com/Cacti/cacti/pull/7163\nhttps://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2"], "statement": "This vulnerability is assessed as having Moderate impact for Red Hat environments because successful exploitation requires an attacker to already possess high-level administrative credentials. The secondary execution of injected database commands occurs only during specific automated rule evaluations triggered by administrators, significantly limiting unauthorized exposure. Additionally, Cacti is not distributed or supported as part of Red Hat Enterprise Linux.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.2.27,1.2.31)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cacti", "source": "cna", "vendor": "Cacti"}, "product": "cacti", "vendor": "cacti"}], "created": "2026-10-23T17:15:07.223046+00:00", "updated": "2026-10-23T23:00:13.057335+00:00", "vendors": ["cacti", "cacti$PRODUCT$cacti"]}