TI-2026-60354 Aliases CVE-2026-89054 GHSA-hcpr-9cm8-436x

OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

MEDIUM 42CWE-862Published 2026-09-10 · Updated 2026-09-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration and SNMP data collection (which enable and disable event definitions and data-collection sources) are reachable with no authorization enforced. An unauthenticated attacker able to reach the web UI can disable event definitions and SNMP data collection, suppressing event and alarm generation and stopping metric collection - silently degrading monitoring and detection - with the change persisted and reloaded into the running system. The solution is to upgrade to Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0051 43rd percentileScored 2026-11-07

Fix Fixed Horizon (The OpenNMS Group): 36.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The OpenNMS Group	Horizon	36.0.0 to before 36.0.4	36.0.4	Patch available	CNA

Horizon VendorThe OpenNMS Group Affected 36.0.0 to before 36.0.4 Fixed in 36.0.4 Patch available CNA

Remediation

Fix · CNA Horizon (The OpenNMS Group) Fixed in 36.0.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-10
The OpenNMS Group Horizon 36.0.4
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-60371 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)Priority LOW 29
- TI-2026-15924 OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS hostPriority LOW 26
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-89054
2026-10-03 Alias added: GHSA-hcpr-9cm8-436x

References

Patch 1

https://github.com/OpenNMS/opennms/pull/8833

TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
TI-2015-06530 OpenNMS has a default password of rtc for the rtc account, which makes it easier for… CVSS 2.0HIGH 10.0
TI-2026-74978 OpenNMS REST authorization bypass via non-canonical HTTP method CVSS 3.1CRITICAL 9.1

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences