Reflected Cross-Site Scripting Vulnerability in OpenNMS Meridian and Horizon

CVE-2026-127235

What is CVE-2026-127235?

A reflected cross-site scripting vulnerability has been identified in the web user interfaces of OpenNMS Meridian and Horizon. This vulnerability allows an attacker to generate a crafted link that, when clicked by an authenticated user, can execute arbitrary JavaScript code within the context of the OpenNMS application. The malicious script executes in the user's browser and may gain access to sensitive page data or send unauthorized requests as the victim. The vulnerability arises due to insufficient output encoding of request parameter values in the web UI. To mitigate this issue, affected users are encouraged to upgrade to the latest versions of Meridian (2024.3.15, 2025.0.12, 2026.0.2) and Horizon (36.0.6) which include necessary fixes to properly encode input data and to disable client-side template evaluation on AngularJS pages.

References