CVE-2026-89054
Received Received - Intake

Missing Authorization in OpenNMS Horizon Allows Configuration Changes

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: The OpenNMS Group

Description
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration and SNMP data collection (which enable and disable event definitions and data-collection sources) are reachable with no authorization enforced. An unauthenticated attacker able to reach the web UI can disable event definitions and SNMP data collection, suppressing event and alarm generation and stopping metric collection - silently degrading monitoring and detection - with the change persisted and reloaded into the running system. The solution is to upgrade to Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-11
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-89054
EUVD
EUVD-2026-75707

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opennms horizon From 36.0.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization flaw in OpenNMS Horizon. It allows unauthenticated users to make configuration changes via the /api/v2 REST API PATCH endpoints. Specifically, it affects event configuration and SNMP data collection, enabling attackers to disable monitoring and metric collection without detection.

Detection Guidance

Check if unauthenticated PATCH requests to /api/v2 endpoints are possible by testing with curl commands like: curl -X PATCH http://<target>/api/v2/event-config or curl -X PATCH http://<target>/api/v2/snmp-data-collection. If these return 200 OK without authentication, the system is vulnerable.

Impact Analysis

An attacker could disable event definitions and SNMP data collection, stopping alarms and metric collection. This silently degrades monitoring and detection capabilities. The changes persist and reload into the running system, making the impact long-lasting.

Compliance Impact

This vulnerability could impact compliance with standards like GDPR and HIPAA by allowing unauthorized changes to monitoring systems. Unauthenticated attackers could disable event definitions and SNMP data collection, which may suppress critical alerts and stop metric collection. This silent degradation could lead to undetected security incidents or compliance violations due to lack of proper monitoring and logging.

Mitigation Strategies

Upgrade OpenNMS Horizon to version 36.0.4 or newer immediately. Ensure the system is not exposed directly to the internet and is isolated within private networks as per installation guidelines.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89054. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart