SQL Injection Vulnerability in Cacti Package: CVE-2026-71287
Summary
DEBIAN-CVE-2026-71287: Cacti's sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Affects cacti versions 1.2.16+ds1-2 – 1.2.31+ds1-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cacti is an open-source network monitoring and graphing tool designed to harness the power of RRDTool's data logging and graphing functionality. It provides a web-based interface for managing network data and visualizing it through graphs. The tool is widely used for monitoring network traffic and performance metrics. However, it is susceptible to a SQL injection vulnerability that can compromise the integrity of the database and expose sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2026-71287 arises from the improper sanitization of user-supplied ORDER BY column names in the sanitize_sql_column function located in lib/functions.php. The regex allowlist used for sanitization permits letters, digits, underscores, parentheses, and dots, which can be exploited by attackers to inject malicious SQL code. This flaw can lead to unauthorized access to the database, data manipulation, and potential data breaches, making it critical for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Cacti application to trusted IP addresses only, thereby limiting the exposure to potential attacks. Additionally, consider implementing web application firewalls (WAF) to filter out malicious requests.
Conclusion
CVE-2026-71287 represents a significant security risk for users of the Cacti package due to its SQL injection vulnerability. It is crucial for users to update their installations to the latest patched version and consider implementing additional security measures to protect their systems.
See every vulnerability recorded for cacti →
FAQ
CVE-2026-71287 is a SQL injection vulnerability in the Cacti package that allows attackers to manipulate SQL queries through unsanitized user input.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to unauthorized database access, data manipulation, and potential data breaches, compromising sensitive information.
Yes, users should update their Cacti package to the latest version that addresses CVE-2026-71287 to mitigate the risk.
The CVSS score for CVE-2026-71287 is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for cacti.
