CVE-2026-111235

Name of the Vulnerable Software and Affected Versions OpenNMS Meridian versions prior to 2024.3.14, 2025.0.11, and 2026.0.1 OpenNMS Horizon versions prior to 36.0.5

Description An authorization bypass exists in the REST API due to improper configuration of Spring Security filter chains. The /rest/** filter chains use intercept-url rules that compare HTTP methods case-sensitively and lack a terminal deny rule. Consequently, requests using non-canonical method tokens, such as lowercase letters, bypass authentication. This allows a remote, unauthenticated attacker to read monitored inventory and create, modify, or delete resources, including the injection of events to fabricate or suppress alarms. Additionally, the /rest/alarms chain lacks a deny rule, leading to an observable response discrepancy that discloses the existence of alarms.

Recommendations Upgrade Meridian to version 2024.3.14, 2025.0.11, or 2026.0.1. Upgrade Horizon to version 36.0.5 or newer. Ensure the software is installed within private networks and is not directly accessible from the Internet.