Authorization Flaw in OpenNMS Products Enables Privilege Escalation

CVE-2026-19182

What is CVE-2026-19182?

An authorization issue in the v2 Alarm REST API of OpenNMS Meridian and Horizon allows low-privileged authenticated users to manipulate alarm states and audit records improperly. Due to an incorrectly inverted credential check, these users can acknowledge, escalate, or clear alarms under arbitrary usernames, even while having read-only permissions. The flaw poses a risk to the integrity of alarm records, facilitating potential unauthorized alterations. Users are advised to update to the respective secure versions and ensure installations are not publicly accessible.

References