Authorization Bypass Vulnerability in OpenNMS Products by OpenNMS

CVE-2026-111235

What is CVE-2026-111235?

An authorization bypass vulnerability in the REST API of OpenNMS Meridian and Horizon allows unauthorized access to sensitive resources. Due to the misconfiguration of Spring Security filter chains, a non-canonical HTTP method token can be processed without authentication, enabling remote attackers to read sensitive monitored inventory and manipulate system resources via the API. This includes the ability to inject events or suppress alarms, ultimately compromising system integrity. The vulnerability is mitigated in newer versions by incorporating a terminal deny rule in the REST filter chains.

References