CVE-2026-40941
Package import signature validation bypass accepts self-signed packages
| CVE | CVE-2026-40941 |
|---|---|
| Status | PUBLISHED 2026-06-25 (GitHub CNA) |
| Product | Cacti |
| Affected | develop branch (1.3.0-dev) — verified at c869d9b2. Not in any stable release. |
| Not affected | 1.2.x stable (its is_cacti_public_key() bool check rejects untrusted keys correctly) |
| Fixed | Unfixed on develop as of report; absent from the 1.2.x line |
| CWE | CWE-347 |
| CVSS 3.1 | 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/CACTI.md |
Detail
import_validate_signature() returns a mixed type — an array for an untrusted key — and the caller applies boolean ! to it. In PHP, !array(...) on a non-empty array is always false, so the rejection branch is unreachable and an untrusted key passes exactly like a trusted one. On main the is_cacti_public_key() check had been removed outright (but main is a historical branch Cacti does not ship from). Branch scope: develop only. On 1.2.x stable, is_cacti_public_key() is a bool check that correctly rejects a self-signed package (FATAL: Package Public Key is not Official Cacti Public Key) — confirmed live, so 1.2.x is not affected.
Remediation
See chains/CACTI.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/CACTI.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-40941.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch