CVE-2026-39948 is a critical SQL injection (CVSS 9.8) in Cacti 1.2.30 and earlier. The rfilter parameter reaches RLIKE clauses without regex validation, and it is reachable before login through graph_view.php when guest graph viewing is on. Cacti 1.2.31 fixes it.
What's affected
Cacti 1.2.30 and prior are affected. The fixed version is 1.2.31.
The pre-authentication path applies to installations with guest graph viewing enabled. The affected code is in lib/html_graph.php and lib/html_tree.php.
How to check if you're exposed
Check the version shown in the Cacti console footer, or on the host:
grep -i "cacti_version" include/cacti_version 2>/dev/null
Then see whether guest graph viewing is enabled under authentication settings, and whether graph_view.php is reachable from the internet.
What to do now
- Upgrade to 1.2.31 or later.
- If you cannot upgrade yet, disable guest graph viewing and restrict access to the web interface.
- Review web and database logs for odd rfilter values.
- Use a database account for Cacti with only the privileges it needs.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
This is CWE-89 (SQL Injection). The raw request value was concatenated into a query, and the check that would have rejected a malformed regex was bypassed by an unbalanced quote. The advisory notes similarity to an earlier Cacti advisory, GHSA-69gg-mjfm-jjpc.
Monitoring tools hold credentials and network maps, so a database compromise there is worth more than its size suggests. The record does not flag this CVE as exploited in the wild.
Quick check
Do I need to be logged in?
Not when guest graph viewing is enabled, per the advisory.
What is the fix?
Cacti 1.2.31.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
