CVE-2026-40941: Cacti Package Import Signature Validation Bypass (CVSS 6.5)

Technical summary

CVE-2026-40941 is a signature validation bypass in Cacti's package import mechanism, classified as an improper verification of cryptographic signature (CWE-347). The vulnerability permits the acceptance of self-signed certificates when importing packages, circumventing the intended chain-of-trust controls. An authenticated user can exploit this to introduce unsigned or self-signed packages into the Cacti environment. The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-accessible vulnerability requiring authentication and low complexity, with high integrity impact but no confidentiality or availability impact. The threat model assumes an attacker with login credentials, making this a post-authentication risk rather than an unauthenticated remote code execution scenario.

Business impact

This vulnerability creates a supply-chain and integrity risk specific to organizations running Cacti as their monitoring backbone. Attackers with valid credentials—whether compromised accounts or insider threats—can install malicious plugins or updates that could tamper with monitoring data, disable alerts, or establish persistence within the management infrastructure. Since Cacti often centralizes visibility into critical network and system health, a compromised instance could mask infrastructure problems or provide an attacker with a vantage point for lateral movement. The medium severity rating reflects the authentication requirement, but the integrity impact is substantial for any organization relying on Cacti's trustworthiness.

Affected systems

Cacti versions 1.2.30 and prior are vulnerable. This includes any deployment running unpatched 1.2.x releases up to and including 1.2.30. Organizations using version 1.2.31 or later are not affected. Given Cacti's prevalence in enterprise monitoring environments, the affected population is potentially significant, though the vendor has not marked this in the Known Exploited Vulnerabilities (KEV) catalog, suggesting no evidence of active exploitation in the wild as of the published date.

Exploitability

Exploitation requires valid Cacti user credentials and network access to the Cacti web interface or API. The technical bar is low—an attacker simply needs to invoke the package import functionality with a crafted self-signed package. No unusual interaction, race conditions, or bypass techniques are needed beyond the signature validation flaw itself. The risk is elevated in environments where account compromise is plausible (weak passwords, credential reuse, or phishing success) or where insider threats are a concern. The absence of KEV designation suggests this has not been publicly exploited, but the straightforward nature of the attack means organizations should not rely on obscurity.

Remediation

The definitive fix is to upgrade Cacti to version 1.2.31 or later. Administrators should verify the integrity of the upgrade package itself before deployment. Until patching is feasible, consider restricting package import functionality to trusted administrators, enforcing strong authentication (multi-factor authentication where possible), and monitoring package import logs for suspicious activity. Do not import packages from untrusted sources, and disable package import if not actively needed.

Patch guidance

Cacti has released version 1.2.31 as the fixed version. Verify your current version via the Cacti admin panel (Settings > General). If running 1.2.30 or earlier, plan an upgrade to 1.2.31 or the latest stable release. Consult the official Cacti release notes and security advisory for any pre-upgrade considerations, database migration steps, or rollback procedures. Test the upgrade in a non-production environment first, and schedule patching during a maintenance window to allow for thorough validation.

Detection guidance

Review Cacti audit and import logs for any package import activities, particularly those initiated by non-administrative accounts or from unexpected sources. Monitor for file system changes within the Cacti plugins directory. Inspect recently imported packages for modifications to legitimate plugin code or presence of unexpected executables. Network-level detection is challenging since this is an authenticated, application-layer issue; focus on access logs and authentication events that might indicate compromised credentials. If available, enable detailed logging in Cacti to capture package import details and cryptographic validation failures.

Why prioritize this

This vulnerability should be addressed in the near term but is not an immediate emergency. The authentication requirement significantly reduces the attack surface compared to unauthenticated remote code execution vulnerabilities. However, the integrity impact—the ability to install malicious monitoring extensions—is substantial and could have cascading consequences if Cacti is mission-critical. Organizations with strong credential hygiene and restricted access to Cacti can deprioritize slightly, while those with broader user access or history of credential compromise should patch sooner. The medium CVSS score aligns with typical patch schedules; treat it as a high-priority update within a monthly patch cycle.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: (1) Network-accessible attack vector with low complexity, (2) requirement for low-privilege authentication, (3) high integrity impact (ability to modify or inject malicious packages), and (4) no direct confidentiality or availability impact from the vulnerability alone. This is a mid-range severity because while the technical impact is significant, the authentication gate and limited scope prevent it from reaching 'critical' thresholds. Real-world risk may be higher in environments where credential compromise is likely; conversely, it may be lower in highly restricted Cacti deployments.

Frequently asked questions