CVE-2026-19596

Received Received - Intake

XXE Vulnerability in OpenNMS Meridian and Horizon

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: The OpenNMS Group

Description

An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitored host or an HTTP man-in-the-middle position), the collector's XML parser resolves external entities and external DTDs. This allows an attacker to read files accessible to the OpenNMS service account, including database credentials, and to induce out-of-band requests. The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-19596

Affected Vendors & Products

Vendor	Product	Version / Range
opennms	meridian	From 2024.3.13 (inc)
opennms	meridian	From 2025.0.10 (inc)
opennms	horizon	From 36.0.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This is an XML External Entity (XXE) vulnerability in OpenNMS Meridian and Horizon. When OpenNMS collects XML from an attacker-controlled source, the XML parser processes external entities and DTDs, allowing attackers to read files accessible to the OpenNMS service account, including sensitive data like database credentials, and perform out-of-band network requests.

Impact Analysis

An attacker could exploit this to access sensitive files on the system running OpenNMS, such as database credentials or configuration files. They could also use it to make unauthorized network requests from the OpenNMS server, potentially leading to further compromise of internal systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information security). Exposure of credentials or data could result in regulatory penalties or breaches of confidentiality obligations.

Mitigation Strategies

Upgrade to Meridian 2024.3.13, 2025.0.10 or Horizon 36.0.4 or newer to address the XXE vulnerability in the XML collector.

Hi! I’m here to help you understand CVE-2026-19596. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70