CVE-2026-40941

MEDIUM

Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages

Title source: cna
STIX 2.1

Description

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed packages. This issue has been fixed in version 1.2.31.

References (3)

Core 3
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/Cacti/cacti/pull/7054

Scores

CVSS v3 6.5
EPSS 0.0016
EPSS Percentile 5.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-347
Status published
Products (2)
cacti/cacti < 1.2.31
Cacti/cacti < 1.2.31
Published Jun 25, 2026
Tracked Since Jun 26, 2026