CVE-2026-111235: CWE-862 Missing Authorization in The OpenNMS Group Meridian
Description
CVE-2026-111235 is a critical authorization bypass vulnerability in the REST API of multiple versions of OpenNMS Meridian and Horizon. The issue arises because the Spring Security filter chains authorize requests based on case-sensitive HTTP method matching without a terminal deny rule. Requests using non-canonical HTTP method tokens (e.g., lowercase) bypass authentication, allowing remote unauthenticated attackers to read, create, modify, or delete monitored resources, including injecting events to manipulate alarms. The vulnerability affects versions prior to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5. The vendor recommends upgrading to these fixed versions. The products are intended for private network deployment and should not be exposed directly to the Internet.
CVSS v3.1
Score 9.1critical
Affected software
The OpenNMS Group
Meridian
The OpenNMS Group
Horizon
pkg:github/MeridianRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
An authorization bypass vulnerability (CWE-862) exists in the REST API of OpenNMS Meridian and Horizon due to case-sensitive HTTP method matching in Spring Security filter chains without a terminal deny rule. Non-canonical HTTP method tokens (such as lowercase) do not match any authorization rule and are processed without authentication. This allows remote unauthenticated attackers to access and manipulate monitored inventory and alarms, including injecting events to fabricate or suppress alarms. The vulnerability affects multiple versions before Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5, where the issue is fixed by adding a terminal deny rule to each REST filter chain.
Potential Impact
Remote unauthenticated attackers can bypass authorization controls in the REST API, enabling them to read sensitive monitored inventory data and create, modify, or delete resources. This includes the ability to inject events that can fabricate or suppress alarms, potentially undermining monitoring and alerting systems. The vulnerability does not affect availability but has high confidentiality and integrity impacts.
Mitigation Recommendations
Upgrade affected OpenNMS Meridian versions to 2024.3.14, 2025.0.11, or 2026.0.1 and Horizon to 36.0.5 or newer, where a terminal deny rule has been added to the REST filter chains to prevent authorization bypass. Additionally, ensure these products are deployed within private networks and are not directly accessible from the Internet, as recommended by the vendor.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- OpenNMS
- Date Reserved
- 2026-10-15T18:22:58.029Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad123c12cdf04f65652b7b1
Added to database: 10/15/2026, 19:04:33 UTC
Last enriched: 10/15/2026, 19:18:18 UTC
Last updated: 10/15/2026, 19:19:21 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.