CVE-2026-111235 The OpenNMS Group CVE debrief

Who should care

Administrators of OpenNMS Meridian and Horizon installations should assess exposure and prioritize upgrading to patched versions to prevent unauthorized access and potential data manipulation. This includes reviewing affected versions, planning vendor-supported updates or mitigations, and verifying remediation.

Why it matters

CVE-2026-111235 is a critical authorization bypass vulnerability in OpenNMS Meridian and Horizon that allows remote attackers to access and manipulate inventory data and resources through the REST API. Defenders should prioritize upgrading to patched versions to prevent unauthorized access and potential data manipulation.

• Remote attackers can read monitored inventory data without authentication
• Remote attackers can create, modify, or delete resources through the REST API
• Remote attackers can inject events to fabricate or suppress alarms
• Verification of affected versions and remediation priority is required

Technical summary

The OpenNMS REST API does not properly handle non-canonical HTTP methods, allowing for an authorization bypass. This vulnerability affects multiple versions of OpenNMS Meridian and Horizon. The issue arises from the /rest/** Spring Security filter chains authorizing requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication.

Defensive priority

High priority for upgrading to patched versions of OpenNMS Meridian and Horizon

Recommended defensive actions

• Upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 or newer
• Upgrade to Horizon 36.0.5 or newer
• Restrict access to the REST API to trusted networks
• Monitor for suspicious activity on the REST API
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in OpenNMS Meridian versions prior to 2024.3.14, 2025.0.11, and 2026.0.1, as well as Horizon version 36.0.0 up to 36.0.5. The fix involves adding a terminal deny rule to each REST filter chain. Source grounding indicates that the CVE record and official advisory provide details on affected versions and remediation steps.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.