CVE-2026-46531: Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)
Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automationtreeruleitems.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/apiautomation.php :: createallheadernodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drpaction=8 ("Apply Automation Rules") bulk action. The result of the injected SELECT is written into graphtreeitems.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cactito a version that resolves this vulnerability.Fixed in 1.2.31
Event History
Frequently Asked Questions
Which users can introduce the malicious SQL fragment?
A user with the Automation realm can store the fragment in automation_tree_rule_items.field. The description identifies this realm as part of the default General Administration role.
What must happen for the stored payload to execute?
An administrator must trigger the standard “Apply Automation Rules” bulk action through graphs.php?action=actions&drp_action=8. The payload is then used in create_all_header_nodes() when Cacti builds the automation results.
What information can an attacker retrieve through this issue?
The injected SELECT result is written to graph_tree_items.title and displayed in the Cacti tree UI. This provides a direct channel for exfiltrating query results visible through that interface.
Which versions require remediation?
Cacti versions 1.2.27 through 1.2.30 are affected. Version 1.2.31 contains the patch.