CVE-2026-49442
Description
A flaw was found in Cacti. This vulnerability allows an unauthenticated remote attacker to perform user enumeration by observing subtle discrepancies in login failure responses. Because the application returns slightly different error messages depending on whether a submitted username exists in the system, an attacker can identify valid user accounts to facilitate targeted attacks.
Statement
Red Hat Product Security has rated this vulnerability as having a Moderate impact because an unauthenticated remote attacker can distinguish valid usernames from invalid ones based on response text differences, enabling username harvesting that aids subsequent brute-force attacks. While remotely exploitable without privileges, the flaw does not disclose sensitive credentials, compromise system integrity, or provide unauthorized administrative access on its own. In typical enterprise Red Hat deployments, Cacti is hosted on internal networks for administrative monitoring rather than exposed to untrusted public environments, which reduces the overall risk of remote exposure.
Understanding the Weakness (CWE)
Confidentiality,Access Control
Technical Impact: Read Application Data; Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
