Read the docs
TI-2026-60371 Aliases CVE-2026-89089GHSA-fcjx-6cv6-5wqj

OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

Priority LOW 29CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports "Maintenance contracts expired" (AssetManagementMaintExpired) and "Maintenance contracts strategy" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings. The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00365 30th percentileScored 2026-11-07
Fix Fixed Meridian (The OpenNMS Group): 2024.3.13, 2025.0.10Horizon (The OpenNMS Group): 36.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The OpenNMS GroupMeridian2024.1.0 to before 2024.3.13; 2025.0.0 to before 2025.0.102024.3.13, 2025.0.10Patch availableCNA
The OpenNMS GroupHorizon36.0.0 to before 36.0.436.0.4Patch availableCNA
  • Meridian VendorThe OpenNMS Group Affected 2024.1.0 to before 2024.3.13; 2025.0.0 to before 2025.0.10 Fixed in 2024.3.13, 2025.0.10 Patch available CNA
  • Horizon VendorThe OpenNMS Group Affected 36.0.0 to before 36.0.4 Fixed in 36.0.4 Patch available CNA

Remediation

  • Fix · CNA Meridian (The OpenNMS Group) Fixed in 2024.3.13, 2025.0.10
  • Fix · CNA Horizon (The OpenNMS Group) Fixed in 36.0.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    The OpenNMS Group Horizon 36.0.4

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-60354 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changesPriority MEDIUM 42
    • TI-2026-15924 OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS hostPriority LOW 26
    Show all 3 records →
  • Release ·

    The OpenNMS Group Meridian 2024.3.13, 2025.0.10

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-15924 OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS hostPriority LOW 26
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-89089
  2. 2026-10-03 Alias added: GHSA-fcjx-6cv6-5wqj

References

Patch 1

  • TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
  • TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
  • TI-2015-06530 OpenNMS has a default password of rtc for the rtc account, which makes it easier for… CVSS 2.0HIGH 10.0
  • TI-2026-74978 OpenNMS REST authorization bypass via non-canonical HTTP method CVSS 3.1CRITICAL 9.1
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences