CVE-2026-127236
Received Received - Intake

Argument Injection in OpenNMS Meridian and Horizon

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: The OpenNMS Group

Description
An argument injection vulnerability exists in the ad-hoc RRD graph feature of multiple versions of OpenNMS Meridian and Horizon. The ad-hoc graph endpoint (GET /graph/graph.png?adhoc=true) copies request parameters into the rrdtool command line without validation. A low-privileged authenticated user (ROLE_USER or ROLE_DASHBOARD) can insert extra rrdtool arguments. An injected --daemon argument makes the server connect to an attacker-chosen address, which is a server-side request forgery. An injected DEF statement reads a local RRD file by absolute path. The command runs through exec with an argument array and no shell, so arbitrary operating system command execution is not possible. The fix validates the ad-hoc graph parameters against allowlists. The solution is to upgrade to Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-127236
EUVD
EUVD-2026-124611

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
The OpenNMS Group Meridian From 2024.1.0 (inc) to 2024.3.15 (exc)
The OpenNMS Group Meridian From 2025.0.0 (inc) to 2025.0.12 (exc)
The OpenNMS Group Meridian From 2026.0.0 (inc) to 2026.0.2 (exc)
The OpenNMS Group Horizon From 36.0.0 (inc) to 36.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an argument injection flaw in OpenNMS Meridian and Horizon's ad-hoc RRD graph feature. The endpoint GET /graph/graph.png?adhoc=true copies request parameters directly into the rrdtool command without validation. A low-privileged authenticated user can inject extra arguments like --daemon to force the server to connect to an attacker-controlled address, causing a server-side request forgery. Another injected argument can read local RRD files by absolute path. The command runs without shell access, preventing arbitrary OS command execution.

Detection Guidance

Check OpenNMS logs for suspicious ad-hoc graph requests to /graph/graph.png?adhoc=true with unusual parameters like --daemon or DEF statements. Monitor network traffic from the OpenNMS server to unexpected external addresses.

Impact Analysis

An attacker with low privileges could exploit this to make the server connect to unintended addresses, potentially leaking internal network information or interacting with other systems. They could also read sensitive RRD files containing historical performance data. The impact is limited to server-side actions and does not allow direct remote code execution.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data stored in RRD files, potentially violating GDPR (data protection) or HIPAA (health information privacy) if such data is exposed. The server-side request forgery could also enable lateral movement within a network, increasing the risk of broader compliance violations.

Mitigation Strategies

Upgrade to Meridian 2024.3.15, 2025.0.12, 2026.0.2 or Horizon 36.0.6 or newer. Ensure OpenNMS instances are not exposed to the internet and restrict access to authenticated users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127236. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...