Signature Validation Bypass in Cacti Performance Management Framework

CVE-2026-40941

What is CVE-2026-40941?

Cacti, an open-source performance and fault management framework, is affected by a vulnerability that allows for a bypass of package import signature validation. This flaw permits the installation of self-signed packages, which could compromise the integrity and security of the system. The issue has been addressed in version 1.2.31, emphasizing the importance of upgrading to maintain secure operations. Administrators using versions 1.2.30 and earlier should prioritize updating to the latest version to mitigate potential risks.

References