CVE-2026-89089

Name of the Vulnerable Software and Affected Versions OpenNMS Meridian versions prior to 2024.3.13 OpenNMS Meridian versions prior to 2025.0.10 OpenNMS Horizon versions prior to 36.0.4

Description A SQL injection issue exists in the JasperReports-based reporting feature. A low-privileged authenticated user with ROLE USER permissions can exploit this by using the reporting REST API endpoint POST /rest/reports/{id} to run the default-enabled reports AssetManagementMaintExpired (Maintenance contracts expired) and AssetManagementMaintStrategy (Maintenance contracts strategy). By providing a malicious DATE FORMAT parameter, which is substituted literally and without escaping into SQL queries, an attacker can execute arbitrary SQL commands against the database. This allows for the retrieval of sensitive data, including notification credentials, provisioning secrets, and SNMP community strings.

Recommendations Upgrade to version 2024.3.13 or newer. Upgrade to version 2025.0.10 or newer. Upgrade to version 36.0.4 or newer. Ensure the software is installed within private networks and not directly accessible from the Internet.