CVE-2026-39894: Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting
Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtoolfunctionupdate() can corrupt RRDtool metric values. The rrdtoolfunctionupdate() function checks metric values with isnumeric() and concatenates them into the RRDtool update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LCNUMERIC uses comma as decimal separator (e.g., deDE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cactito a version that resolves this vulnerability.Fixed in 1.2.31 - Configuration
Ensure the server/PHP locale (LC_NUMERIC) does not use a comma as the decimal separator for Cacti’s rrdtool_function_update() path; RRDtool expects '.' so values like 1.5 must not become "1,5".
PHP/Server locale LC_NUMERIC decimal separator = dot (.)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39894?
The severity of CVE-2026-39894 is classified as low, with a score of 2.9.
What versions of Cacti are affected by CVE-2026-39894?
CVE-2026-39894 affects Cacti versions 1.2.30 and below.
How do I fix CVE-2026-39894?
To fix CVE-2026-39894, upgrade to a version of Cacti that is higher than 1.2.30.
What kind of vulnerability is CVE-2026-39894?
CVE-2026-39894 is a locale-dependent decimal formatting issue that can corrupt RRDtool metric values.
What components of Cacti does CVE-2026-39894 impact?
CVE-2026-39894 specifically impacts the rrdtool_function_update() in Cacti.