CVE-2026-40941

MediumCVSS 6.5/10Last modified Jun 29, 2026

Description

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed packages. This issue has been fixed in version 1.2.31.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
Cacti	cacti	< 1.2.31

References

https://github.com/Cacti/cacti/pull/7054Issue Tracking, Patch
https://github.com/Cacti/cacti/releases/tag/release%2F1.2.31Product, Release Notes
https://github.com/Cacti/cacti/security/advisories/GHSA-274c-97hj-pv2vVendor Advisory

Timeline

Published: Jun 25, 2026
Last modified: Jun 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-409426.3The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OI CVE-2026-409438.7Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure CVE-2026-409446.9Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the f CVE-2026-409458.7Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG CVE-2026-409469.2Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: CVE-2026-409472.9Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path.CVE-2026-409485.4The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on t CVE-2026-409494.4CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access Windows client prior to 14.50. Attackers with local control of the CVE-2026-409506.5CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access server prior to 14.50. Attackers with control of a modified client c CVE-2026-409515.5CVE-2026-40951 is a memory corruption vulnerability on Secure Access Windows clients prior to 14.50. Attackers with local control of the W CVE-2026-409527.8CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Atta CVE-2026-409534.4CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access a