CVE-2026-39894: Cacti RRDtool Metric Corruption via Locale-Dependent Decimal Formatting

Technical summary

The vulnerability exists in the rrdtool_function_update() function, which validates metric values using PHP's is_numeric() check and then interpolates them directly into RRDtool commands via string concatenation. PHP's type casting of floats is locale-aware: when LC_NUMERIC is set to a locale using comma as the decimal separator (e.g., de_DE.UTF-8), a float value of 1.5 is converted to the string "1,5" rather than "1.5". Since RRDtool exclusively expects periods as decimal separators, the malformed data either gets assigned to incorrect columns in the RRDtool database or is silently rejected. The vulnerable code path contains no explicit setlocale() reset after PHP's locale-dependent operations, allowing the misconfiguration to propagate through the update cycle. This manifests as a CWE-474 (Use of Unvalidated Input in Format String) class defect—the metric data format is not validated against RRDtool's expectations before transmission.

Business impact

Silent data corruption in your monitoring infrastructure undermines situational awareness. If your Cacti deployment uses a comma-decimal locale, historical metrics become unreliable, trending data diverges from reality, and alerting thresholds may trigger incorrectly or fail to alert on genuine anomalies. Unlike a crash or outage, this corruption is invisible—administrators may act on false metrics, miss real problems, or spend cycles investigating ghost issues. For environments relying on Cacti for SLA reporting or incident correlation, corrupted data cascades into flawed post-mortems and compliance gaps. The low severity reflects that exploitation requires deliberate locale misconfiguration rather than network access, but the business consequence—loss of monitoring fidelity—is material for any organization using Cacti in production.

Affected systems

Cacti version 1.2.30 and all earlier versions are vulnerable. The flaw manifests only when the underlying server's LC_NUMERIC locale is set to use comma as the decimal separator (common in European, Latin American, and other locales). Systems running Cacti on English locales (en_US, en_GB) with period-based decimal formatting are not affected. Affected deployments are typically UNIX/Linux systems with non-English locale configurations, particularly those in enterprises with regional locale preferences. Windows deployments using locales with comma separators are similarly at risk.

Exploitability

This is not remotely exploitable. Triggering the flaw requires local server configuration—specifically, that the system's LC_NUMERIC environment variable or locale setting uses comma as the decimal separator. An attacker cannot remotely change locale settings to trigger the vulnerability. The vulnerability requires no user interaction or privilege escalation; it is a passive data integrity issue that occurs whenever metrics are processed by a vulnerable Cacti instance running under a comma-decimal locale. The low CVSS score (2.9) reflects the local-only attack vector and high environmental specificity.

Remediation

Upgrade Cacti to version 1.2.31 or later, which corrects the locale-sensitive formatting issue. For environments unable to immediately patch, two compensating controls are available: (1) ensure the Cacti process runs under a locale with period-based decimal formatting (e.g., export LC_NUMERIC=C or LC_NUMERIC=en_US.UTF-8 in the service startup environment), or (2) apply a PHP wrapper or locale-reset logic around the vulnerable function via a local patch, though this is not recommended as a permanent solution. Validate that any locale changes are applied consistently across all Cacti processes (daemon, web interface, CLI tools).

Patch guidance

Verify your current Cacti version via the web interface (Settings > About) or command line (cacti --version). If running 1.2.30 or earlier, plan an upgrade to 1.2.31 or the latest stable release. Review vendor release notes at the official Cacti project repository or advisory pages to confirm patch applicability. Because Cacti often manages critical infrastructure metrics, coordinate the upgrade during a maintenance window and test the upgrade in a non-production environment first to ensure compatibility with your RRDtool and PHP versions. After patching, verify that historical data remains accessible and that new metric collection proceeds without errors.

Detection guidance

Check your Cacti deployment's locale settings by examining environment variables (echo $LC_NUMERIC) and system locale configuration (locale). Audit your Cacti process startup scripts and systemd service files to identify any explicit locale exports. Review RRDtool database integrity: export recent metrics to CSV and inspect decimal formatting—if commas appear in numeric fields, your system is affected. Monitor Cacti logs for any errors or warnings during metric updates that might indicate data rejection. Consider adding locale checks to your deployment validation automation. Post-patch, re-verify locale settings and re-test metrics to confirm data integrity is restored.

Why prioritize this

Although the CVSS score is low, this vulnerability should not be ignored. Organizations with European or other non-English locale configurations face silent data corruption that undermines monitoring reliability. The fix is simple and carries low deployment risk (a minor version bump). Prioritize patching for Cacti instances in regulated environments where monitoring data feeds compliance reporting, and for instances supporting alert-driven incident response. Low-priority deployments (non-critical monitoring, test environments) can be patched in routine maintenance windows.

Risk score, explained

The CVSS 3.1 score of 2.9 (LOW) reflects: Attack Vector: Local (server locale configuration only, not network-exploitable). Attack Complexity: High (requires specific, non-default locale configuration). Privileges Required: None (occurs during normal operation). User Interaction: None. Scope: Unchanged. Confidentiality: None (no data exposure). Integrity: Low (data is corrupted/misaligned but not exfiltrated). Availability: None (monitoring continues but is unreliable). The score accurately penalizes the local-only nature and environmental specificity but does not fully capture the operational risk of silent metric corruption in a monitoring framework. Organizations should weight their own risk tolerance for data integrity above the base CVSS.

Frequently asked questions