User Enumeration Vulnerability in Cacti Open Source Management Framework

CVE-2026-49442

What is CVE-2026-49442?

Cacti, a popular open-source performance and fault management framework, is impacted by a user enumeration vulnerability that allows attackers to discern valid usernames. This occurs due to inconsistent error messages generated during the login process. When an existing username is used, the application responds with 'Access Denied! Login failed' (with a lowercase 'f'), whereas for non-existent usernames, it returns 'Access Denied! Login Failed' (with an uppercase 'F'). This inconsistency can enable attackers to systematically identify valid usernames, amplifying the risk of unauthorized access or targeted attacks. The vulnerability has been addressed in version 1.2.31.

References