CVE-2026-94826
Unauthenticated REST API exposes internal network topology
| CVE | CVE-2026-94826 |
|---|---|
| Status | RESERVED |
| Product | Cacti |
| Affected | develop branch, <= 1.3.0-dev |
| Fixed | a8e1afba7393 (2026-08-21) on develop — ships in no tagged release; newest is release/1.2.31 (2026-06-15) |
| CWE | CWE-306 |
| CVSS 3.1 | 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/CACTI.md |
Detail
api/public/index.php includes global.php but never auth.php, and no API key, token, session or IP middleware exists. 13 endpoints under /api/public/v1/ expose monitored-host IPs and hostnames, internal subnet ranges, DNS configuration, exact software versions and database status.
Scope: develop branch only; the code ships in no tagged release and requires composer install for Slim 4. Reported as GHSA-mx5c-qj6m-2w89; no vendor action.
Remediation
See chains/CACTI.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/CACTI.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-94826.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch