SQL Injection Vulnerability in OpenNMS Reporting Feature

CVE-2026-89089

What is CVE-2026-89089?

A SQL injection vulnerability exists in the reporting feature of OpenNMS Meridian and Horizon, allowing low-privileged authenticated users to manipulate SQL queries through the reporting REST API. By supplying a DATE_FORMAT parameter, attackers can execute arbitrary SQL commands, potentially accessing sensitive information stored within the database, such as credentials and SNMP community strings. It is crucial for users to upgrade to the latest versions to mitigate this security risk.

References