Authorization Flaw in OpenNMS Horizon Web Interface

CVE-2026-89054

What is CVE-2026-89054?

A significant authorization flaw exists in the OpenNMS Horizon web interface, where configuration changes can be made without any authentication. This vulnerability stems from the Spring Security policy, which defines authorization rules for every HTTP method, except for PATCH. As a result, the associated @PATCH endpoints for event configuration and SNMP data collection are left exposed without necessary authorization. An unauthorized attacker, having access to the web UI, can exploit this flaw to disable event definitions and halt SNMP data collection, leading to suppressed alerts and unmonitored metrics. The changes made remain persistent in the system, adversely affecting monitoring capabilities. Organizations should promptly upgrade to version 36.0.4 or newer to rectify this issue and ensure the security of their internal networks.

References