CVE-2026-89089 The OpenNMS Group CVE debrief

Who should care

OpenNMS administrators and users with access to the reporting feature should be aware of this vulnerability. They should assess their exposure, prioritize remediation, and monitor for suspicious activity. Security teams and vulnerability management teams should also be informed to ensure proper mitigation and remediation efforts.

Why it matters

CVE-2026-89089 is a SQL injection vulnerability in OpenNMS Meridian and Horizon that allows low-privileged users to execute arbitrary SQL queries. Defenders should assess exposure, prioritize remediation, and monitor for suspicious activity.

• Read arbitrary data from the OpenNMS database
• Access sensitive data such as provisioning and notification credentials
• Potential for lateral movement within the network
• Requires verification of affected versions and remediation status

Technical summary

The vulnerability exists in the JasperReports-based reporting feature of OpenNMS Meridian and Horizon. A low-privileged authenticated user can supply a malicious DATE_FORMAT parameter to execute arbitrary SQL queries. This allows for unauthorized access to sensitive information, including database-stored secrets. The solution is to upgrade to fixed versions of Meridian and Horizon. Technical details indicate that the vulnerability is related to the reporting REST API and default-enabled online reports. Defenders should focus on upgrading to fixed versions and restricting access to the reporting API.

Defensive priority

Upgrade to fixed versions; restrict reporting API access; monitor for suspicious queries

Recommended defensive actions

• Upgrade to Meridian 2024.3.13, 2025.0.10, or Horizon 36.0.4
• Restrict access to the reporting REST API
• Monitor database queries for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the SQL injection vulnerability in OpenNMS Meridian and Horizon. The vulnerability allows low-privileged users to execute arbitrary SQL queries. Evidence is based on the official CVE Program record and NIST NVD vulnerability detail. The reporting feature's default-enabled online reports, such as 'Maintenance contracts expired' and 'Maintenance contracts strategy,' are susceptible to exploitation. Defenders should verify affected versions and review the supplied official advisory for more

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.