IT SBIT Services
Schneeberger
DEEN
CVE tracker

OpenNMS Meridian and Horizon: Authorization bypass in REST API

CVE-2026-111235Critical 9.1

← All vulnerabilities

Summary

Multiple versions of OpenNMS Meridian and Horizon contain an authorization bypass in the REST API. REST requests that use a non-canonical HTTP method token, such as a lowercase method name, match no authorization rule and are processed without authentication. A remote, unauthenticated attacker can read the monitored inventory, create, modify or delete resources, and inject events to fabricate or suppress alarms. The /rest/alarms endpoint also reveals whether a specific alarm exists.

Affected

  • OpenNMS Group Meridian 2024.1.0 to before 2024.3.14
  • OpenNMS Group Meridian 2025.0.0 to before 2025.0.11
  • OpenNMS Group Meridian 2026.0.0 to before 2026.0.1
  • OpenNMS Group Horizon 36.0.0 to before 36.0.5
  • Older branches: Unknown.

Fixed in

  • Meridian 2024.3.14
  • Meridian 2025.0.11
  • Meridian 2026.0.1
  • Horizon 36.0.5 or newer

Workaround

  • No vendor workaround known.
  • Restrict access to the OpenNMS web and REST ports to management networks or a VPN until patched.
  • Block external access to /rest/ paths at the perimeter until patched.

Exploitation

  • No known exploitation in the wild.
  • CISA SSVC: Exploitation none, automatable yes, technical impact total.
  • No public proof of concept found.
  • NVD analysis pending.

Our recommendation

  • Inventory all OpenNMS Meridian and Horizon instances and their versions.
  • Upgrade to Meridian 2024.3.14, 2025.0.11 or 2026.0.1, or Horizon 36.0.5 or newer, depending on the branch.
  • Confirm that no instance is reachable from the internet and restrict REST access to trusted hosts until patched.
  • Review REST and alarm logs for unauthenticated requests and for unexpected alarm or event injection or deletion.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:30.

Original description (NVD)

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed