CVE-2026-40083: Authenticated SQL Injection in Cacti <= 1.2.30 managers.php Exposes Full Database
The Yokai research team at Hakai Security disclosed CVE-2026-40083, a SQL injection vulnerability in Cacti versions up to and including 1.2.30. An authenticated user with SNMP management (agent) permissions can run arbitrary SQL queries, reading or modifying the entire database. Exposed data includes bcrypt credential hashes, API tokens, …