Argument Injection Vulnerability in OpenNMS Meridian and Horizon Products
CVE-2026-127236

5.4MEDIUM

Key Information:

Vendor

The Opennms Group

Status
Meridian
Horizon
Vendor
CVE Published:
12 November 2026

What is CVE-2026-127236?

A vulnerability in the ad-hoc graph feature of OpenNMS Meridian and Horizon allows low-privileged authenticated users to inject unauthorized arguments into the rrdtool command line. This flaw enables a user with ROLE_USER or ROLE_DASHBOARD to manipulate parameters, potentially causing the server to connect to malicious addresses, thereby facilitating server-side request forgery. Although arbitrary operating system command execution is not feasible due to command execution methods, this vulnerability underscores the necessity of upgrading to the latest versions for enhanced security. Relevant installation guides emphasize securing these platforms within private networks.

Affected Version(s)

Horizon 36.0.0 < 36.0.6

Meridian 2024.1.0 < 2024.3.15

Meridian 2025.0.0 < 2025.0.12

References

https://github.com/OpenNMS/opennms/pull/9065
patch

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alexandre Rolim
.