CVE-2026-46531

Name of the Vulnerable Software and Affected Versions Cacti versions 1.2.27 through 1.2.30

Description An authenticated stored second-order SQL injection exists in the automation tree rule item handler. A user with the Automation realm (General Administration role) can store an arbitrary SQL fragment in the field column of the automation tree rule items table. This fragment is concatenated into a SELECT clause within the create all header nodes() function in lib/api automation.php and executed when an administrator uses the 'Apply Automation Rules' bulk action via the 'graphs.php?action=actions&drp action=8' endpoint. The result is written to graph tree items.title and displayed in the UI, allowing for data exfiltration.

Recommendations Update to version 1.2.31.