CVE-2026-111235

Received Received - Intake

Authorization Bypass in OpenNMS REST API

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: The OpenNMS Group

Description

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111235

EUVD

EUVD-2026-102324

Affected Vendors & Products

Vendor	Product	Version / Range
The	OpenNMS	Group Meridian 2024.1.0
The	OpenNMS	Group Meridian 2025.0.0
The	OpenNMS	Group Meridian 2026.0.0
The	OpenNMS	Group Horizon 36.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is an authorization bypass vulnerability in OpenNMS Meridian and Horizon REST APIs. Requests using non-canonical HTTP methods (like lowercase) bypass authentication because the security filter chains compare methods case-sensitively. This allows unauthenticated attackers to read inventory, modify resources, delete data, or inject fake alarms through the REST API.

Impact Analysis

An attacker could exploit this to access sensitive monitoring data, alter system configurations, delete critical resources, or manipulate alarms. This could disrupt network monitoring, hide security incidents, or trigger false alerts. The impact is severe due to the lack of authentication requirement for affected endpoints.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized access to sensitive monitoring data, which could lead to breaches of confidentiality under GDPR or HIPAA. Organizations using affected versions may face compliance violations and regulatory penalties.

Mitigation Strategies

Upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 or Horizon 36.0.5 or newer. Ensure OpenNMS instances are not directly accessible from the Internet as per installation instructions.

Hi! I’m here to help you understand CVE-2026-111235. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70