Read the docs
TI-2026-74978 Aliases CVE-2026-111235

OpenNMS REST authorization bypass via non-canonical HTTP method

Priority MEDIUM 47CWE-204Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-204 and CWE-862.

Summary

OpenNMS Meridian from 2024.1.0 before 2024.3.14, from 2025.0.0 before 2025.0.11 and from 2026.0.0 before 2026.0.1, and OpenNMS Horizon from 36.0.0 before 36.0.5, contain an authorization bypass in the REST API (CWE-862). The REST filter chains match HTTP methods case-sensitively and lack a terminal deny rule, so a request using a non-canonical method token skips authorization. A remote, unauthenticated attacker can read the monitored inventory and create, modify or delete resources, including injecting events to fabricate or suppress alarms.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00376 31st percentileScored 2026-11-07
Fix Fixed Meridian (The OpenNMS Group): 2024.3.14, 2025.0.11, 2026.0.1Horizon (The OpenNMS Group): 36.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The OpenNMS GroupMeridian2024.1.0 to before 2024.3.14; 2025.0.0 to before 2025.0.11; 2026.0.0 to before 2026.0.12024.3.14, 2025.0.11, 2026.0.1Patch availableCNA
The OpenNMS GroupHorizon36.0.0 to before 36.0.536.0.5Patch availableCNA
  • Meridian VendorThe OpenNMS Group Affected 2024.1.0 to before 2024.3.14; 2025.0.0 to before 2025.0.11; 2026.0.0 to before 2026.0.1 Fixed in 2024.3.14, 2025.0.11, 2026.0.1 Patch available CNA
  • Horizon VendorThe OpenNMS Group Affected 36.0.0 to before 36.0.5 Fixed in 36.0.5 Patch available CNA

Remediation

Upgrade Meridian to 2024.3.14, 2025.0.11 or 2026.0.1, and upgrade Horizon to 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within private networks and should not be directly accessible from the Internet.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Meridian (The OpenNMS Group) Fixed in 2024.3.14, 2025.0.11, 2026.0.1
  • Fix · CNA Horizon (The OpenNMS Group) Fixed in 36.0.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    The OpenNMS Group Horizon, Meridian 2024.3.14, 2025.0.11 and 2 more versions

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-74979 Denial of service in OpenNMS Meridian and Horizon via XML entitiesPriority LOW 28
    Show all 2 records →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111235
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-18 CISA SSVC decision points changed
  4. 2026-10-18 Priority changed: LOW → MEDIUM

References

Patch 1

  • TI-2021-07941 Cross-site request forgery in OpenNMS CVSS 3.1HIGH 8.8
  • TI-2021-07943 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07939 Cross-site scripting in OpenNMS CVSS 3.1MEDIUM 4.8
  • TI-2021-07940 Cross-site request forgery in OpenNMS CVSS 3.1MEDIUM 4.3
  • TI-2015-06530 OpenNMS has a default password of rtc for the rtc account, which makes it easier for… CVSS 2.0HIGH 10.0
  • TI-2020-10145 An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19… CVSS 3.1HIGH 8.8
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences